GHSA-8wjr-gw73-9f2g

A non-administrator account that holds only the delegated "Videos Admin" permission (Permissions::PERMISSION_FULLACCESSVIDEOS, Permissions plugin, enabled by default) can obtain a full administrator session without knowing any administrator credential.

objects/aVideoEncoderStatus.json.php → EncoderJobStatus::inspect() returns a fresh video_id_hash to any logged-in caller for whom Video::canEncoderEdit($videos_id) is true. That check falls back to Video::canEdit(), which returns true for every Videos Admin on any video, including videos owned by the administrator. However video_id_hash is not a per-caller edit token. It is bound to the video owner (ownerFingerprint = owner's users.password + saltV2), and useVideoHashOrLogin() exchanges it for a password-less User::login(true) as the owner. The Videos Admin requests the hash for an admin-owned video, replays it from a cookie-less session, and receives an administrator session cookie.