CVE-2026-86725

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw (CWE-639) in the SocialMediaPublisher plugin's add.json.php endpoint. An authenticated user can supply arbitrary row IDs to overwrite another user's stored access_token and refresh_token for a connected social media provider, and can then delete the record to destroy that user's provider linkage. The flaw carries no confidentiality impact per the CVSS 4.0 score, but the unauthenticated-write aspect yields a high integrity impact on victims' OAuth connections. Only AVideo deployments with the SocialMediaPublisher plugin enabled and user-facing accounts are affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known; EPSS assigns a 0.3% probability of exploitation within 30 days.

What to do: Update AVideo to a release newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a patched version is available, or disable the SocialMediaPublisher plugin if it is not required. As an interim mitigation, restrict access to add.json.php to trusted accounts. Audit existing SocialMediaPublisher token records for unexpected modifications or deletions and rotate any stored OAuth access and refresh tokens as a precaution.