WWBN AVideo CVE-2026-90552

The two vulnerable endpoints - Playlists_schedules/list.json.php and Live/calendar.json.php - must be network-reachable, which applies to any internet-facing or intranet-accessible AVideo installation. Two distinct exploitation paths exist: (1) fully unauthenticated, requiring no credential or session token whatsoever; and (2) authenticated with the canStream privilege level, which is the lowest non-anonymous application role in AVideo. The vulnerability is bounded to versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. Exploitation is structurally limited to read-only metadata disclosure (schedule names, descriptions, timestamps, playlist identifiers); no media content, credentials, write operations, or privilege escalation vectors are accessible via this path. The discrepancy between the description's mention of unauthenticated access and the CVSS PR:L vector is a data-quality concern that defenders should verify with the vendor.

The CVSS 4.0 score of 5.3 with VC:L accurately reflects the limited blast radius - only read-only schedule metadata is exposed, with no write capability, credential leakage, or content-file access involved. However, the provided CVSS 4.0 vector uses PR:L (low privileges), which conflicts with the description's explicit statement that unauthenticated users can also reach these endpoints; a PR:N vector would be more consistent with the actual exploitation surface and this discrepancy should be clarified by the vendor. EPSS data is absent from the available intelligence, but the combination of low VC:L impact, no KEV listing, and no identified public exploit code indicates speculative exploitation risk rather than an active threat. Even a mid-sized municipal IT team in opole relying on AVideo for internal schedule management should evaluate whether private playlists carry operationally sensitive scheduling information before treating this as low-priority, since metadata exposure can aid social engineering or reconnaissance even without direct content access. Overall this is a genuine but moderate-severity information disclosure warranting patching rather than emergency response.

An unauthenticated attacker sends HTTP GET requests to Playlists_schedules/list.json.php or Live/calendar.json.php with sequentially or arbitrarily chosen playlist identifier values; the server responds with private schedule names, descriptions, timestamps, and playlist IDs without checking whether the requester owns the referenced playlist. By iterating over a range of identifiers, the attacker can enumerate the full private schedule catalog across all users on the platform. No public POC code has been identified, but the attack requires only a standard HTTP client and knowledge of the endpoint paths.