CVE-2026-58003

The CVSS 7.1 score for CVE-2026-58003 fundamentally misrepresents the severity of this issue. The vulnerability isn't that releaseVideoNow.json.php lacks a CSRF token — it's that a GET request can permanently publish any video in the system, regardless of embargo status. The HTTP specification reserves GET for idempotent reads, not irreversible state changes. By treating these semantics as interchangeable, AVideo has created an attack surface where CSRF tokens are only a partial mitigation. The videos_id parameter is the critical exploitation detail. An attacker can target any video by ID — not just their own content. For organizations using AVideo for embargoed releases, this means premature publication of competitor announcements, NDA violations, or scheduled content disruption. If admin panels use sequential or predictable ID schemes, enumeration becomes trivial. Worse than the endpoint itself is what happens after publication triggers. This endpoint doesn't just flip a database flag — it initiates downstream cascades: push notifications, RSS syndication, third-party embeds, and CDN invalidation chains. These are irreversible once initiated. There's no compensation logic, no rollback mechanism, and critically, no guarantee this endpoint even generates audit logs. An attack could propagate through external systems and leave zero forensic trace in your own infrastructure. The regression question matters: check commit 9c39d8c8 to determine whether CSRF protections existed previously and were lost. If this is a regression, expect similar gaps in other admin endpoints — the PHP CMS pattern of CVE-triggered hardening followed by feature-driven regression is well-documented. Map all JSON endpoints accepting GET requests and treat them as suspect until proven otherwise.

Reviewed through automated stages and approved by a human before publication.