CVE-2026-89243

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 stores user group names without sanitizing the group_name input in UserGroups::setGroup_name(), resulting in a stored cross-site scripting flaw (CWE-79). An administrator holding the canAdminUserGroups permission can save a group name containing malicious HTML or JavaScript, which then executes in the browser of any other administrator who opens the user manager interface. By running script in other admins' sessions, the attacker can hijack those sessions, perform administrative actions in their name, or maintain persistence within the admin UI. Any organization running an affected AVideo build with multiple administrative accounts, where not every canAdminUserGroups holder is fully trusted, is exposed. There is no public proof-of-concept, the issue is not in CISA's KEV, and no in-the-wild exploitation is currently known.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1, since no fixed version number is provided in the advisory data. Until patched, restrict the canAdminUserGroups permission to fully trusted administrators and audit existing user group names for injected HTML or JavaScript. Check whether any group names contain script payloads that could have already executed against other admins.