Executive brief
WWBN AVideo is a video streaming platform that manages playlists and live content. The platform fails to properly check ownership of private playlists when serving schedule information, allowing authenticated users and guest visitors to view private schedule names, descriptions, and timing details they should not have access to. This could expose sensitive scheduling information and enable competitive or malicious intelligence gathering against content creators.
Technical details
The vulnerability is a missing authorization check (CWE-862, CWE-639) in two JSON API endpoints: `Playlists_schedules/list.json.php` and `Live/calendar.json.php`. The list endpoint requires only the basic `canStream()` permission and calls `Playlists_schedules::getAll()` without filtering for ownership; the calendar endpoint is completely unauthenticated. Both endpoints return private playlist schedule metadata (name, description, timestamps, playlists_id) without verifying the caller owns the playlist. The sibling endpoint `playlistsVideos.json.php` correctly implements access control and returns HTTP 403 for non-owners. An attacker with stream privileges (or no authentication via the calendar path) can enumerate and retrieve all private playlist schedules by querying these endpoints. No patch was available at the time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-f4q2-49rm-rxh7 published
- 2026-09-12: advisory: CVE-2026-90552 published on NVD