WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php. Attackers can exploit this by providing any valid daily token obtained from Live pages to access scheduler email jobs without authentication. This enables enumeration of scheduler jobs, reading of private live titles and email addresses, and triggering of email sending. The vulnerability is rated with a CVSS 4.0 score of 8.8 (high severity) with no privileges required, no user interaction, and network attack vector.

An unauthenticated attacker with access to a valid daily token can enumerate scheduler jobs, access private information such as live stream titles and email addresses, and trigger email sending. This could lead to privacy breaches and unauthorized email dispatches, potentially facilitating further attacks or spam. There is no indication of privilege escalation or direct code execution from the provided data.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to daily tokens and monitor usage of the Scheduler's sendEmail.json.php endpoint to detect unauthorized access attempts.