CVE-2026-90552 — WWBN AVideo Missing Authorization via Playlists_schedules list.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endp…
Published: 2026-09-12 · CVSS: 5.3 · CVSS 4.0
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7