ETK-2026-4233Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4233",
  "cve_id": null,
  "display_id": "ETK-2026-4233",
  "ghsa_id": "GHSA-g69x-xc9q-2g2v",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authorization bypass in AVideo MP4 import",
  "summary": "AVideo's MP4 import functionality does not verify that an uploading user is allowed to manage the selected media. When Import MP4 is enabled, an account with upload permission may copy another user's restricted video and associated metadata into its own account, and may remove the original content. The issue requires an authenticated user with upload permission and the import feature enabled.",
  "mitigation": "Disable the Import MP4 feature until the import path enforces ownership or edit authorization for the resolved media target. Limit upload-capable accounts and prevent the import endpoint from accepting paths to per-video media directories; no fixed package release is recorded.",
  "vendor": "php",
  "product": "AVideo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 29.7.1"
      ],
      "ecosystem": "php",
      "fixed_versions": [],
      "package_name": "AVideo",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 25.62019555,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-11-12T00:21:31.630126+00:00",
      "days": -0.05819990421296296,
      "is_lower_bound": true,
      "measured_at": "2026-11-12T01:45:20.142976+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-11T16:24:21+00:00",
      "days": -0.3895729380787037,
      "is_lower_bound": true,
      "measured_at": "2026-11-12T01:45:20.142976+00:00",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g69x-xc9q-2g2v"
    },
    "trigger_signal": {
      "at": "2026-11-11T16:24:21+00:00",
      "days": -0.3895729380787037,
      "is_lower_bound": true,
      "measured_at": "2026-11-12T01:45:20.142976+00:00",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g69x-xc9q-2g2v"
    }
  }
}