CVE-2026-57944

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8

Description A cross-site request forgery issue exists in the 'channelToGallery.json.php' endpoint. This flaw allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. By crafting a cross-site GET request that utilizes an administrator's session cookie, an attacker can promote arbitrary channels to the front page or delete curated sections because the system fails to perform token validation.

Recommendations Update AVideo to the version containing commit 9c39d8c8 or later.