SSRF in Saloon PHP and Auth Model Leak in AVideo Expose Sensitive Data

Two newly disclosed vulnerabilities expose sensitive information in widely used web application components. CVE-2026-33182 affects Saloon PHP and allows unauthenticated, network-based server-side request forgery (SSRF) that can leak API credentials and session tokens, potentially granting attackers access to integrated third-party services and enabling misuse of those external environments. The issue carries a CVSS 4.0 score of 6.6 and is described as a high-confidentiality-impact flaw, with the host application's local database remaining intact even as connected systems may be exposed.

A separate issue, CVE-2026-33501, affects the WWBN AVideo Permissions Plugin and discloses an application's internal authorization model by revealing mappings between user groups and specific plugins. Although rated lower at CVSS v3.1 5.3 and not associated with credential or personally identifiable information exposure, the flaw provides valuable reconnaissance that can help attackers identify privileged roles, map the attack surface, and support follow-on privilege escalation attempts against vulnerable authenticated extensions.