Executive brief
WWBN AVideo is a live streaming and video management platform. A flaw in the reminder creation feature allows authenticated users to create reminders for private live schedules they cannot normally access, enabling them to discover and learn details about other users' private schedules through generated email notifications.
Technical details
The vulnerability is a missing authorization check (CWE-862, CWE-639) in plugin/Live/remindMe.json.php. The endpoint accepts a live_schedule_id parameter and calls Live::setLiveScheduleReminder without verifying the caller has permission to view or access the target schedule. An authenticated attacker can bypass access controls by directly submitting a schedule ID they discovered, creating a reminder and triggering an email job that includes the private schedule title. The Live/list.json.php endpoint correctly restricts visibility, but remindMe.json.php does not perform equivalent authorization checks. Root cause: missing visibility validation before reminder creation. Requires user authentication but no other preconditions. Fix status: unfixed at time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed
- 2026-09-12: advisory