CVE-2026-90552: WWBN AVideo Missing Authorization via Playlists_schedules list.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlistsschedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.
Affected Software
Event History
Frequently Asked Questions
Who can access the exposed schedule metadata?
The affected endpoints can be queried without authentication. Users with canStream privileges can also retrieve the data, and neither case requires ownership of the target playlist.
What information could be disclosed?
An attacker can retrieve private playlist schedule names, descriptions, timestamps, and playlist identifiers. The issue affects the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints.
How can I determine whether my deployment is affected?
Check whether the deployment includes code through commit c3edcc274c389816d434acadac07ee78eaf330c1, then test whether the two endpoints return private playlist schedule metadata to an unauthenticated request or a user that does not own the playlist.