CVE-2026-90537: WWBN AVideo Scheduler sendEmail Missing Authorization via Token
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs any valid site-wide daily token obtained from Live pages. No authentication or user interaction is required.
Which data and actions are exposed?
An attacker can enumerate scheduler email jobs, read private live titles and email addresses, and trigger email sending through the affected Scheduler endpoint.
Are installations affected by default?
The available information identifies the Scheduler plugin endpoint plugin/Scheduler/sendEmail.json.php as affected, but does not state whether the Scheduler plugin is enabled by default.
What can be done if patching is not immediately possible?
The provided information does not list a workaround. Restricting access to the affected Scheduler endpoint would address the exposed path, but no specific mitigation is documented in the supplied data.