WWBN/AVideo: Delegated Users Admin can delete or modify administrator accounts

Summary

A non-administrator account granted the delegated "Users Admin" permission (Permissions::PERMISSION_USERS) could delete administrator accounts through the user deletion endpoint. The server checked whether the actor could manage users but did not enforce the administrator boundary for the target account. The endpoint could delete the target's videos before deleting the account.

Review also identified the same missing target authorization in objects/userAddNew.json.php: a delegated Users Admin could change an administrator's password, email and other account fields. Saving through this path also demoted the target because User::setIsAdmin() does not permit a non-admin actor to set the administrator flag.

Impact and prerequisites

Exploitation requires an authenticated account explicitly granted the Users Admin permission, plus valid request tokens and the deletion endpoint's CAPTCHA. Ordinary authenticated users are not granted arbitrary account-management access by this finding.

An attacker with this delegated role could delete administrator accounts and their content, or modify and demote administrator accounts, blocking legitimate administrative access. The confirmed paths do not grant the attacker the administrator flag. No confidentiality impact or escape from the application's security authority was demonstrated.

Severity: Moderate, CVSS 3.1: 6.5 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. Privileges Required is High because exploitation requires a role with broad user-account management authority; integrity and availability impacts include destructive changes to administrator accounts and content.

Affected builds

The original report examined master commit 8a32cc70a4758c74c54cdc80c592f11514debcb2. The vulnerable authorization checks were also verified in 2db920d3326729743511a27de44034b0a6c78b05, the parent of the fix. Earlier introduction and release-version boundaries have not been established; this advisory does not claim that every earlier version is affected.

Reproduction

Use a disposable installation of an affected build with an administrator target and a separate non-admin actor granted only the Users Admin permission.

1. Authenticate as the delegated actor and obtain the valid request token and CAPTCHA required by the application.
2. Submit POST /plugin/CustomizeUser/confirmDeleteUser.json.php with users_id set to the administrator target, captcha set to a valid answer, and a valid globalToken.
3. The affected endpoint accepts the administrator target and proceeds to delete its videos and account without requiring a true administrator actor.
4. For the account-editing path, submit the normal user-manager request to objects/userAddNew.json.php with the administrator's id, a valid securityToken and the required account fields. The affected code applies the changes and demotes the target instead of rejecting the operation.

Patch and upgrade guidance

Update to commit 9c7cadaee8f472e9f6584b941af1bdaed5668145 or a later build containing this fix. A numbered patched release has not been verified.

The patch requires User::isAdmin() when the target is an administrator in User::delete(), plugin/CustomizeUser/confirmDeleteUser.json.php, plugin/API/API.php's set_api_user_delete(), and objects/userAddNew.json.php. Endpoint checks precede video deletion. UserAccountMutationLock serializes guarded mutations with existing-account saves and re-reads the target's administrator flag to address concurrent promotion. Failed lock acquisition rejects the operation.

Until updated, remove the delegated Users Admin permission from accounts that should not have administrator-equivalent control over administrator accounts.

Report scope

The reported ability to use the "Use this user" support feature for ordinary users is intentional behavior of the Users Admin role and is excluded from this vulnerability. The role already manages those users' password/email; the swap endpoint already rejects administrator targets. The patch does not remove this support feature.

Credit

AlpetGexha discovered and reported the administrator-account deletion issue. The related administrator-editing path was identified during maintainer review.

References

• Fix: https://github.com/WWBN/AVideo/commit/9c7cadaee8f472e9f6584b941af1bdaed5668145
• Vulnerable deletion endpoint: https://github.com/WWBN/AVideo/blob/2db920d3326729743511a27de44034b0a6c78b05/plugin/CustomizeUser/confirmDeleteUser.json.php
• Vulnerable account editing: https://github.com/WWBN/AVideo/blob/2db920d3326729743511a27de44034b0a6c78b05/objects/userAddNew.json.php
• CWE-863: Incorrect Authorization