CVE-2026-89257: AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check
AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce before passing the attacker-supplied $REQUEST['id'] to Category::deleteAssets(), which recursively removes {systemRootPath}videos/categories/assets/{id}/. It omits the Category::userCanEditCategory() ownership check enforced by the sibling Category::delete(). On installations where the non-default usersCanCreateNewCategories setting is enabled, an authenticated non-admin user with the canUpload capability can send a POST request with an arbitrary category ID and recursively delete any category's on-disk asset directory (icons/images). Category records and videos are not deleted. As of the advisory publication no patched version was available.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects AVideo installations through 29.0 where the non-default usersCanCreateNewCategories setting is enabled. The attacker must be an authenticated non-admin user with canUpload capability.
What does an attacker need to submit to exploit it?
An attacker needs a valid authenticated session, the ability to create categories, a valid CSRF nonce, and an arbitrary target category ID in a POST request to objects/categoryDeleteAssets.json.php. No administrator privileges or ownership of the target category are required.
What is deleted if exploitation succeeds?
The vulnerable operation recursively deletes the target category's on-disk asset directory, including category icons and images. It does not delete category records or videos.
What can be done if a patch is not available?
Disable the non-default usersCanCreateNewCategories setting to prevent non-admin users from meeting the category-creation capability requirement. The advisory states that no patched version was available at publication.