A vulnerability exists in the Scheduler plugin of the AVideo open source video platform that allows any unauthenticated user to send simple GET requests to three endpoints named list.json.php. These endpoints provide full listings of scheduled tasks, internal callback URLs and parameters, as well as the email messages composed by administrators and the mappings that associate user IDs with email addresses. Because no authentication check is performed, an attacker can read this sensitive data without logging in, exposing potentially valuable operational information and user correspondence. The weakness involved is a missing authentication guard, leading to accidental data exposure rather than code execution or denial of service.

This issue applies to all AVideo releases up to and including version 26.0. The affected product is the AVideo video platform from WWBN. A patch that addresses the missing authentication checks is available in commit 83390ab1fa8dca2de3f8fa76116a126428405431 and should be applied to bring the software past version 26.0.

The CVSS score of 5.3 indicates moderate severity. EPSS score less than 1% reflects a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated HTTP GET request to the public endpoints, so the attack vector is likely remote over the network. While the impact is confined to confidentiality, the ease of access makes the risk significant for environments where the platform is exposed to untrusted users.