Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-12T13:16:53.747Z",
  "pubdate": "2026-09-12T13:16:53.747Z",
  "executiveSummary": "WWBN AVideo contains an improper authorization vulnerability in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, affecting versions through commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe vulnerability stems from a failure to perform server-side validation of playlist ownership, which allows both authenticated and unauthenticated users to access sensitive metadata.\nThe impact includes the unauthorized disclosure of private playlist schedules, including internal identifiers, timestamps, titles, and descriptions.\nThis flaw effectively bypasses privacy controls, allowing an attacker to map private content structures within an AVideo instance.\nThe attack requires no special privileges, as the vulnerable endpoints do not verify the requester's identity or their relationship to the requested data, exposing the metadata to any network-accessible party.",
  "technicalDetails": "The root cause of this vulnerability is the absence of access control checks (ACLs) within the controller logic for the Playlists_schedules/list.json.php and Live/calendar.json.php files.\nIn the affected AVideo architecture, these specific JSON endpoints are designed to return scheduled playlist information. However, the server-side code fails to implement a check to ensure that the user requesting the data possesses valid ownership or appropriate permissions over the requested playlist entities.\nWhen a user sends a request to these endpoints, the application performs a database query to retrieve schedule records. Because the query logic is not scoped by user ID or session permissions, the database returns data for every playlist schedule present in the system regardless of its visibility status or private configuration.\nAn attacker can exploit this by sending a standard HTTP GET request directly to these endpoints. Since the server does not check for an authenticated session or compare the 'user_id' associated with the schedule against the 'user_id' in the session object, the application returns the full payload of the query result.\nThe information leakage includes detailed metadata, such as: unique playlist identifiers (ID), descriptive labels, specific timestamps governing scheduled content delivery, and additional metadata regarding the content schedule. This metadata provides an attacker with a comprehensive map of how, when, and what content is scheduled within the platform.\nThe scope of this vulnerability extends to unauthenticated users, meaning the service does not enforce any gatekeeping for these endpoints. Even if an attacker does not have 'canStream' privileges, the server logic processes the request as if it were legitimate, exposing private information by design flaw rather than implementation error.\nThis vulnerability highlights a critical failure in the application's authorization layer, specifically the 'Insecure Direct Object Reference' (IDOR) pattern applied to information retrieval endpoints. The lack of granular permission checks allows for complete enumeration of private scheduling metadata.\nThe post-exploitation impact allows an adversary to gain operational intelligence regarding the platform's private content roadmap and metadata structure, which could be used to facilitate further targeted attacks against private or protected media assets."
}