CVE-2026-33761: 
PHP vulnerability analysis and mitigation

CVE-2026-33761 is an unauthenticated information disclosure vulnerability in WWBN AVideo's Scheduler plugin, where three list.json.php endpoints lack authorization checks, exposing scheduled tasks, admin email content, and user-to-email mappings to any unauthenticated attacker. It affects AVideo versions up to and including 26.0. The vulnerability was published on March 24, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory). A patch commit was published on March 27, 2026 (AVideo Commit).

The root cause is a missing authorization check (CWE-862) combined with exposure of sensitive information to unauthorized actors (CWE-200). Three PHP files in the Scheduler plugin — plugin/Scheduler/View/Scheduler_commands/list.json.php, plugin/Scheduler/View/Emails_messages/list.json.php, and plugin/Scheduler/View/Email_to_user/list.json.php — call getAll() (which executes SELECT * FROM {table}) without first invoking User::isAdmin(), unlike every sibling endpoint in the same directories. An attacker needs only to send unauthenticated HTTP GET requests to these endpoints; no session cookie, token, or credentials are required. The Scheduler_commands table exposes callbackURL, parameters, status, timezone, and cron fields; Emails_messages exposes full HTML email bodies and subjects; and Email_to_user maps users_id to emails_messages_id (GitHub Advisory, AVideo Security Advisory).

Successful exploitation allows an unauthenticated remote attacker to read the full contents of three database tables without any credentials. Exposed data includes internal server URLs and API endpoint structures (enabling potential SSRF follow-on attacks), complete HTML email bodies and subjects composed by administrators, and user ID-to-email campaign mappings that facilitate user enumeration and targeted account attacks. There is no direct integrity or availability impact, but the disclosed reconnaissance data significantly lowers the barrier for more severe follow-on attacks (GitHub Advisory).

A proof-of-concept exploit consisting of simple curl commands is publicly documented in the official security advisory, requiring no weaponization or special tooling (AVideo Security Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.044% (12th percentile), indicating a low current probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify internet-facing AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to the target's AVideo installation path.
2. Retrieve scheduled tasks: Send an unauthenticated GET request to the Scheduler_commands endpoint to expose internal callback URLs, parameters, cron schedules, and task status:

   curl -s 'https://target/plugin/Scheduler/View/Scheduler_commands/list.json.php' | jq '.data[] | {id, callbackURL, parameters, status, type}'

3. Retrieve admin email content: Send an unauthenticated GET request to the Emails_messages endpoint to read full HTML email bodies and subjects:

   curl -s 'https://target/plugin/Scheduler/View/Emails_messages/list.json.php' | jq '.data[] | {id, subject, message}'

4. Retrieve user-to-email mappings: Send an unauthenticated GET request to the Email_to_user endpoint to enumerate which user IDs are targeted by which email campaigns:

   curl -s 'https://target/plugin/Scheduler/View/Email_to_user/list.json.php' | jq '.data[] | {users_id, emails_messages_id, sent_at}'

5. Leverage disclosed data: Use discovered internal callbackURL values to probe for SSRF vulnerabilities, or use enumerated users_id values to conduct targeted account attacks against the platform (AVideo Security Advisory).

• Network: Unauthenticated HTTP GET requests to any of the following paths from external or unexpected IP addresses:
  • /plugin/Scheduler/View/Scheduler_commands/list.json.php
  • /plugin/Scheduler/View/Emails_messages/list.json.php
  • /plugin/Scheduler/View/Email_to_user/list.json.php
• Logs: Web server access logs showing 200 OK responses to the above endpoints from unauthenticated sessions (no session cookie present); repeated or automated requests to these endpoints in short succession suggesting scripted enumeration.
• Network: Subsequent outbound connections from the AVideo server to internal or unusual IP addresses that match callbackURL values exposed by the scheduler endpoint, which may indicate follow-on SSRF exploitation attempts (AVideo Security Advisory).

The fix is to add User::isAdmin() authorization checks to all three vulnerable list.json.php files, matching the pattern already used by sibling endpoints (add.json.php, delete.json.php, index.php). The patch was committed in AVideo commit 83390ab (AVideo Commit). Administrators should update AVideo to a version incorporating this commit (post-26.0). As an interim workaround, web server rules (e.g., .htaccess or nginx location blocks) can be used to restrict access to the three vulnerable endpoints to authenticated sessions or trusted IP ranges. Additionally, review web server logs for prior unauthenticated access to these endpoints to assess potential exposure.

The vulnerability was reported by researcher "offset" and published by DanielnetoDotCom (the AVideo maintainer) on March 24, 2026, with a patch committed shortly after (GitHub Advisory). A brief write-up was published by Infinitsec covering the unauthenticated access issue. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation.