CVE-2026-58002

This vulnerability isn't a missing authorization check — it's the quiet elevation of a non-security feature into an authorization primitive without anyone noticing the trust boundary crossing. The Users_affiliations table was built to track referral relationships, likely for bonuses or social features. It was designed under assumptions of non-adversarial input: no cryptographic proof of consent, no server-side timestamp generation, no cross-user verification. That was appropriate for its original purpose. The failure occurred when someone later implemented video ownership reassignment and reached for the existing 'consented' flag without asking who set that flag or whether it could be forged. The commit diff that connects these two features is the actual crime scene — it shows the moment a developer trusted a non-security-grade signal for a security-critical operation. The client-supplied timestamp vulnerability is the exploit vector, but it's symptomatic of a deeper pattern: the original feature's design decisions were never annotated with security context in version control, so future developers had no way to know this field was never meant to cross a trust boundary. The blast radius extends forward, not just backward. Any developer in 2026 who builds a new security-relevant feature in AVideo and sees `status='a'` in the users_affiliations table will assume it's a valid authorization signal — because that's what the existing codebase already teaches them. The affiliation table now functions as a persistent contamination of the trust model, an active teaching tool that will generate future vulnerabilities until its role in authorization is either decommissioned or rebuilt with adversarial input assumptions from the ground up. The fix will likely add server-side timestamp validation, but that patch addresses only one detonation path. The table itself remains entropy in database form, and any new field added by the patch will itself become the next implicit trust signal for a future developer who needs a 'server-authoritative' timestamp. Organizations should audit which downstream subsystems currently treat affiliation consent as authorization, treat the table as a deprecated authorization primitive pending redesign, and encode security annotations directly in version control metadata so that future developers can see which fields were never designed to resist forgery.

Reviewed through automated stages and approved by a human before publication.