CVE-2026-90552: WWBN AVideo Information Disclosure Flaw

CVE-2026-90552 Overview

CVE-2026-90552 is a missing authorization vulnerability in WWBN AVideo, an open-source video streaming and content management platform. The flaw exists through commit c3edcc274c389816d434acadac07ee78eaf330c1 and stems from the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints failing to validate playlist ownership. Authenticated users with canStream privileges and, in some cases, unauthenticated users can read private playlist schedule metadata. Exposed data includes schedule names, descriptions, timestamps, and playlist identifiers. The issue is classified as [CWE-639]: Authorization Bypass Through User-Controlled Key.

Critical Impact
Attackers can enumerate private playlist schedules and harvest metadata from AVideo instances without proper ownership validation, exposing internal broadcast planning information.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Playlists_schedules/list.json.php endpoint
Live/calendar.json.php endpoint

Discovery Timeline

2026-09-12 - CVE-2026-90552 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90552

Vulnerability Analysis

The vulnerability resides in two AVideo endpoints that return playlist schedule data as JSON. Both endpoints query the underlying data store for schedule records but do not verify that the requesting user owns the referenced playlist. As a result, the response includes metadata belonging to other users, including private schedule entries. Attackers can iterate over playlist identifiers or query broad calendar ranges to retrieve schedule names, descriptions, timestamps, and playlist identifiers. The disclosed information can support reconnaissance of internal broadcast plans and correlate user activity across the platform.

Root Cause

The root cause is a missing authorization check on user-controlled identifiers, matching the [CWE-639] pattern. The endpoints trust request parameters to select records without ensuring the authenticated principal has ownership of, or explicit access to, the referenced playlists. In the Playlists_schedules/list.json.php path, canStream privilege is sufficient to reach the query logic. The Live/calendar.json.php path can be reached without authentication in affected configurations.

Attack Vector

Exploitation occurs over the network against the AVideo web interface. An attacker sends HTTP requests to the affected JSON endpoints with parameters targeting arbitrary playlist identifiers or date ranges. The server returns schedule metadata regardless of ownership. No user interaction is required, and privileges range from canStream down to unauthenticated access depending on the endpoint. See the GitHub Security Advisory and the VulnCheck Security Advisory for full technical details.

Detection Methods for CVE-2026-90552

Indicators of Compromise

Unexpected HTTP GET requests to /plugin/PlayLists/Objects/Playlists_schedules/list.json.php or /plugin/Live/Objects/calendar.json.php.
Enumeration patterns cycling through sequential playlist or schedule identifiers within short time windows.
Requests to schedule endpoints originating from canStream accounts that do not own the referenced playlists.

Detection Strategies

Review web server access logs for repeated calls to the affected JSON endpoints and correlate with the authenticated user identity.
Alert on anomalous ratios between playlist ownership and playlist identifiers requested by a single session.
Baseline normal calendar and schedule API usage per user and flag deviations exceeding the baseline.

Monitoring Recommendations

Forward AVideo web and application logs to a centralized analytics platform for enrichment and long-term retention.
Monitor for outbound egress of large JSON payloads from the AVideo application server to unusual destinations.
Track the introduction and use of new canStream accounts and audit their access patterns against private content.

How to Mitigate CVE-2026-90552

Immediate Actions Required

Restrict network access to the AVideo administrative and streaming endpoints using a reverse proxy or web application firewall.
Audit accounts that hold the canStream privilege and revoke access for users who do not require it.
Review recent access logs for the affected endpoints to identify unauthorized enumeration prior to remediation.

Patch Information

At publication time, remediation guidance is tracked in the GitHub Security Advisory GHSA-f4q2-49rm-rxh7. Administrators should upgrade to a build published after commit c3edcc274c389816d434acadac07ee78eaf330c1 that adds ownership validation to Playlists_schedules/list.json.php and Live/calendar.json.php. Confirm the fix by verifying that requests for non-owned playlist identifiers return an authorization error.

Workarounds

Block direct external access to Playlists_schedules/list.json.php and Live/calendar.json.php at the proxy layer until patched.
Enforce authentication on the calendar endpoint by requiring valid session cookies at the web server tier.
Rate-limit requests to the schedule and calendar JSON endpoints to hinder identifier enumeration.

bash

# Example nginx configuration to restrict access to affected endpoints
location ~* /(Playlists_schedules/list\.json\.php|Live/calendar\.json\.php)$ {
    allow 10.0.0.0/8;
    deny all;
    limit_req zone=avideo_api burst=5 nodelay;
}