CVE-2026-90537
Received Received - Intake

Unauthenticated Scheduler Job Access in AVideo

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90537
EUVD
EUVD-2026-76855

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90537 is a missing authorization vulnerability in WWBN AVideo's plugin/Scheduler/sendEmail.json.php. It allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate jobs, read private live titles and email addresses, and trigger email sending without proper authentication.

Detection Guidance

Check for unauthorized access to the plugin/Scheduler/sendEmail.json.php endpoint by monitoring HTTP requests containing the site-wide daily token. Look for GET or POST requests to this path without valid session authentication. Use tools like curl to test the endpoint: curl -X GET 'http://<target>/plugin/Scheduler/sendEmail.json.php?token=<daily_token>' and verify if it returns scheduler data without proper authorization.

Impact Analysis

This vulnerability allows attackers to access sensitive data like private live titles and email addresses. They can also trigger unauthorized email sends, potentially leading to data leaks or misuse of email functionality. The high CVSS score indicates significant risk of data exposure and unauthorized actions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal data (email addresses) and potential data breaches. Exposure of private live titles and email addresses may violate privacy requirements under these regulations.

Mitigation Strategies

Immediately restrict access to the plugin/Scheduler/sendEmail.json.php endpoint by implementing proper authorization checks. Bind tokens to specific users and purposes to prevent unauthorized access. Update to the latest patched version if available. If no patch exists, disable the endpoint or restrict access via firewall rules until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90537. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart