CVE-2026-90537 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo represents a critical failure in access control mechanisms within the application's scheduling subsystem. Specifically located in the file plugin/Scheduler/sendEmail.json.php, this flaw stems from an insufficient verification of user privileges before executing sensitive operations related to email job management. The core technical issue is that the endpoint relies on a site-wide daily token for authorization rather than implementing granular, per-user or session-based authentication checks. This architectural decision creates a significant security gap because it assumes that possession of this single rotating token equates to administrative authority over all scheduled tasks, regardless of the requester's actual role or permissions within the application.
From an operational perspective, this missing authorization vulnerability allows unauthenticated attackers to interact with the scheduler email jobs without valid user credentials. By simply obtaining a valid daily token, which can be easily harvested from public Live pages on any instance running AVideo, an attacker gains the ability to enumerate existing scheduler jobs. This enumeration capability exposes internal system states and operational details that should remain hidden from external actors. The lack of proper access control means that the application fails to distinguish between legitimate administrative requests and malicious attempts by unauthorized parties, effectively bypassing intended security boundaries.
The impact of this vulnerability extends beyond mere information disclosure. Attackers can read private live titles and email addresses associated with scheduled jobs, leading to a severe compromise of user privacy and potentially facilitating further social engineering or phishing attacks against affected users. Furthermore, the ability to trigger email sending by supplying any valid daily token poses a direct risk to system integrity and reputation. This functionality could be abused for spamming, distributing malicious content via automated emails, or causing denial-of-service conditions through excessive email generation. The ease of exploitation lowers the barrier for entry, allowing even low-skilled attackers to leverage this flaw against vulnerable instances.
In terms of industry standard classifications, this vulnerability aligns with CWE-284 Improper Access Control and CWE-306 Missing Authentication for Critical Function. It also maps to MITRE ATT&CK techniques related to Discovery and Execution, specifically leveraging API endpoints to gather information or perform unauthorized actions within the application environment. The reliance on a predictable or publicly accessible token for critical administrative functions is a fundamental design flaw that contradicts principles of least privilege and defense in depth.
To mitigate this vulnerability, developers must implement robust authentication and authorization checks at every entry point handling sensitive data or system-altering operations. Specifically, the sendEmail.json.php endpoint should verify not only the presence of a token but also validate that the associated user session possesses the necessary administrative privileges to execute email scheduling tasks. Replacing site-wide tokens with unique, per-session identifiers tied to authenticated users would significantly reduce the attack surface. Additionally, implementing rate limiting and monitoring for unusual patterns in job creation or execution can help detect and prevent abuse of this functionality. Regular security audits focusing on access control logic are essential to ensure that such gaps do not persist in future releases.