WWBN AVideo up to 26.0 Email Message list.json.php User::isAdmin authorization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in WWBN AVideo up to 26.0. The impacted element is the function User::isAdmin of the file list.json.php of the component Email Message Handler. The manipulation leads to authorization. This vulnerability is documented as CVE-2026-33761. The attack can be initiated remotely. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 26.0 and classified as problematic. This issue affects the function User::isAdmin of the file list.json.php of the component Email Message Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests. Commit 83390ab1fa8dca2de3f8fa76116a126428405431 contains a patch.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-33761 since 03/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

By approaching the search of inurl:list.json.php it is possible to find vulnerable targets with Google Hacking.

Applying a patch is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 26.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion