CVE-2026-90542 describes an authorization bypass vulnerability in WWBN AVideo, introduced as of commit c3edcc274c389816d434acadac07ee78eaf330c1. The vulnerability occurs because the application does not verify that logged-in users have permission to access live schedules before allowing them to create reminders through remindMe.json.php. As a result, authenticated attackers with limited privileges can create scheduler reminders for private live schedules they cannot otherwise access and retrieve the private schedule titles from the email jobs generated by the system.

An authenticated attacker with limited privileges can bypass authorization controls to create reminders for private live schedules they are not authorized to view. This leads to unauthorized disclosure of private schedule titles via email notifications. The vulnerability does not appear to allow modification or deletion of schedules, nor does it enable remote code execution or privilege escalation beyond the disclosure of schedule titles.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions where possible and monitor for suspicious reminder creation activity related to private schedules.