AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: phishing
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-34611
CWE: CWE-352
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

## Summary The AVideo endpoint `objects/emailAllUsers.json.php` allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets `SameSite=None` on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. The endpoint does not call `save()` on any ORM object, which means the Referer/Origin domain validation implemented in `ObjectYPT::save()` is never triggered, leaving CSRF as the only required protection - and it is absent. ## Details The endpoint performs an admin check at line 10 but has no CSRF token validation: ```php // objects/emailAllUsers.json.php:10 if (!User::isAdmin()) { die('{"error": "Must be admin"}'); } ``` The message body is taken directly from POST data at line 41: ```php // objects/emailAllUsers.json.php:41 $obj->message = $_POST['message']; ``` The message is rendered as HTML in the email at line 48: ```php // objects/emailAllUsers.json.php:48 $mail->msgHTML($obj->message); ``` When the `email` POST parameter is omitted, the endpoint defaults to sending to all registered users by calling `User::getAllUsers()`. This means the attacker does not need to know any email


Mitigations:

Architectural layers (MAESTRO):