CVE-2026-33761

WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests. Commit 83390ab1fa8dca2de3f8fa76116a126428405431 contains a patch.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WWBN/AVideo/commit/83390ab1fa8dca2de3f8fa76116a126428405431	Patch
https://github.com/WWBN/AVideo/security/advisories/GHSA-j724-5c6c-68g5	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 26.0 inclusive, tres puntos finales ’list.json.php’ en el plugin Scheduler carecen de cualquier verificación de autenticación, mientras que cualquier otro punto final en los mismos directorios del plugin (’add.json.php’, ’delete.json.php’, ’index.php’) requiere ’User::isAdmin()’. Un atacante no autenticado puede recuperar todas las tareas programadas (incluyendo URLs de callback internas y parámetros), mensajes de correo electrónico compuestos por administradores y mapeos de segmentación de usuario a correo electrónico enviando solicitudes GET simples. El commit 83390ab1fa8dca2de3f8fa76116a126428405431 contiene un parche.

Information

Published : 2026-03-27 15:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-33761

Mitre link : CVE-2026-33761

CVE.ORG link : CVE-2026-33761

JSON object : View

Products Affected

wwbn

avideo

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-862

Missing Authorization

{"id": "CVE-2026-33761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33761", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T17:21:06.213364Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}]}], "published": "2026-03-27T15:16:58.223", "references": [{"url": "https://github.com/WWBN/AVideo/commit/83390ab1fa8dca2de3f8fa76116a126428405431", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j724-5c6c-68g5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests. Commit 83390ab1fa8dca2de3f8fa76116a126428405431 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, tres puntos finales \u2019list.json.php\u2019 en el plugin Scheduler carecen de cualquier verificaci\u00f3n de autenticaci\u00f3n, mientras que cualquier otro punto final en los mismos directorios del plugin (\u2019add.json.php\u2019, \u2019delete.json.php\u2019, \u2019index.php\u2019) requiere \u2019User::isAdmin()\u2019. Un atacante no autenticado puede recuperar todas las tareas programadas (incluyendo URLs de callback internas y par\u00e1metros), mensajes de correo electr\u00f3nico compuestos por administradores y mapeos de segmentaci\u00f3n de usuario a correo electr\u00f3nico enviando solicitudes GET simples. El commit 83390ab1fa8dca2de3f8fa76116a126428405431 contiene un parche."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}