WWBN AVideo CVE-2026-90542

Exploitation requires an authenticated session on the AVideo instance (PR:L); unauthenticated access is not sufficient. The target AVideo deployment must have at least one private live schedule configured - instances with no private schedules have nothing to disclose. The attacker must know or enumerate valid schedule identifiers. The email reminder feature must be functional (mail delivery configured). No special platform or non-default configuration beyond these is required. Limiting factors: the disclosed data is restricted to the private schedule title only (not video content or credentials), no privilege escalation or remote code execution is possible, and the integrity impact is limited to spurious reminder job creation.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) accurately reflects a moderate-severity, low-impact authorization bypass. Real-world risk is limited: exploitation requires an existing authenticated session, the disclosure is confined to the title of a private live schedule (not its content or credentials), and the integrity impact is low (creating unauthorized reminder entries). No public exploit code exists and this CVE has no CISA KEV listing, making active mass exploitation unlikely. Even a mid-sized AVideo deployment in an organization like one in walbrzych would be exposed only if they operate private live schedules and have a meaningful user base that could abuse the reminder feature. The absence of a specific patched release version in available data introduces some remediation uncertainty, though the GitHub security advisory is the authoritative reference. Overall this is a real but low-urgency authorization control gap, not a high-priority incident-response trigger.

An authenticated low-privilege AVideo user sends a crafted POST request to remindMe.json.php supplying the identifier of a private live schedule they are not authorized to view. AVideo creates the reminder job without an authorization check and the resulting email job construction exposes the private schedule's title to the requesting user. No public exploit code is required - the attack is trivially reproducible by any logged-in account.