CVE-2026-58001

The CVSS 5.7 assigned to this vulnerability fundamentally misrepresents the risk because it treats this as a typical CSRF case — it isn't. The AVideo endpoint `objects/videoEditLight.php` accepts GET requests for ownership transfer, which violates HTTP semantics (GET is defined as safe and idempotent) and bypasses the threat model every CSRF mitigation assumes. Standard defenses target POST/PUT/DELETE specifically because GET should be harmless. By accepting GET for a privilege-elevation operation, AVideo placed itself outside that model entirely. What makes this severe is the stored, passive trigger. The payload lives in the video description field — every page view, including by administrators performing their normal moderation workflow, re-triggers the ownership transfer. No click required, no link to click, no spear-phishing needed. An admin simply visiting a compromised video page executes the attack. This isn't user-initiated interaction; it's adversarial content weaponizing routine administrative behavior. Your first diagnostic step: examine commit 9c39d8c8 and determine whether it enforces POST-only semantics or merely adds a CSRF token while retaining GET acceptance. If it's the latter, the architectural vulnerability persists — future developers will inherit and reuse the GET handler because the pattern exists. The semantic violation becomes invisible under the appearance of protection. Second, audit the broader `objects/` directory. These files respond to direct HTTP requests by design, which creates the ergonomic path developers use for debugging — and that same path enables the img tag attack vector. Other privileged operations likely share this pattern. The real blast radius extends beyond ownership transfer itself: video ownership gates monetization controls, reporting capabilities, and playlist management. An attacker accumulating dozens of videos through this vector gains a persistent, low-profile foothold that compounds over time and blends into normal creator behavior. Third, your remediation scope includes historical content cleanup. Patching the code doesn't cleanse malicious payloads already embedded in video descriptions. Every legacy video description is a potential re-trigger point until sanitized. The exposure window doesn't close when the patch lands — it closes when the last malicious payload is purged, which could take weeks in a content-heavy instance.

Reviewed through automated stages and approved by a human before publication.