plugin/Live/view/deleteHistory.json.php and plugin/Live/view/finishAll.json.php mutate global live state on GET. The only check is User::isAdmin() . There is no CSRF token and no POST requirement.
autoCSRFGuard() runs only on POST to *.json.php . A GET never reaches it.
An attacker who can make an administrator's browser request these URLs deletes every live-transmission history row, or marks lives finished.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
deleteHistory.json.php calls LiveTransmitionHistory::deleteALL() . finishAll.json.php calls finishALLOffline() , and with all=1 calls finishALL() . Both files read $_REQUEST and do not call forbidIfNotPost() or forbidIfInvalidToken() .
plugin/Live/view/Live_restreams/testRestreamer.json.php is the same class for any User::canStream() session: GET creates a test restream history row.
Live is operator-enabled on this install. The files ship with the Live plugin.
Fix: forbidIfNotPost() and forbidIfInvalidToken() at the top of each file.
Lab: , commit c3edcc274c389816d434acadac07ee78eaf330c1 , admin session, Referer: .
One GET from an administrator session wipes the live history table. finishAll marks streams finished. testRestreamer.json.php creates extra history rows as any streamer.
WWBN/AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23).
Unfixed at time of reporting.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
