AVideo Insecure Direct Object Reference Vulnerability Allowing Arbitrary File Deletion

A vulnerability exists in AVideo versions prior to 20.0, where an insecure direct object reference (IDOR) allows authenticated users to delete media files belonging to other users. The issue arises because the affected endpoint, while validating authentication, does not check ownership or editing permissions for the targeted videos.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of media files, potentially leading to data loss for affected users.

Remediation

Users can upgrade to AVideo version 20.0 or later, which addresses this vulnerability by implementing proper ownership and permission checks. Instructions for updating AVideo can be found in the AVideo Release Notes.