WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests. Commit 83390ab1fa8dca2de3f8fa76116a126428405431 contains a patch.
References
| Link | Resource |
|---|---|
| https://github.com/WWBN/AVideo/commit/83390ab1fa8dca2de3f8fa76116a126428405431 | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-j724-5c6c-68g5 | Exploit Vendor Advisory |
Configurations
History
31 Mar 2026, 18:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* | |
| First Time |
Wwbn
Wwbn avideo |
|
| References | () https://github.com/WWBN/AVideo/commit/83390ab1fa8dca2de3f8fa76116a126428405431 - Patch | |
| References | () https://github.com/WWBN/AVideo/security/advisories/GHSA-j724-5c6c-68g5 - Exploit, Vendor Advisory |
27 Mar 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-27 15:16
Updated : 2026-03-31 18:38
NVD link : CVE-2026-33761
Mitre link : CVE-2026-33761
CVE.ORG link : CVE-2026-33761
JSON object : View
Products Affected
wwbn
- avideo