A missing authorization vulnerability in WWBN AVideo allows unauthenticated attackers to access scheduler jobs and trigger unauthorized email communications.

The vulnerability exists in the plugin/Scheduler/sendEmail.json.php file, which fails to verify user authorization. An unauthenticated attacker can leverage a site-wide daily token to enumerate jobs and read sensitive information such as live titles and email addresses.

This vulnerability poses a significant risk to data privacy and system integrity. With a CVSS score of 8.2, an attacker can harvest sensitive internal information and abuse the scheduler functionality to send unauthorized emails, which may lead to phishing campaigns or reputational damage.

Immediate Action: Update the AVideo installation to a version beyond the affected commit range. Refer to the official vendor advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-qq59-3jwp-hgj9 for specific remediation steps.

Proactive Monitoring: Review application access logs for repeated access to the scheduler endpoint or unusual patterns of token usage.

Compensating Controls: Restrict access to the scheduler functionality at the network or web server level if immediate patching is not feasible.

Public Exploit Available: No

The exposure of private live titles and email addresses necessitates prompt action. Administrators should apply the recommended security updates immediately to ensure that authorization checks are properly enforced on the scheduler endpoints.