What is GHSA-7cf9-xwv8-6722?

GHSA-7cf9-xwv8-6722 is a security advisory published by GitHub Security Advisories with High severity. WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing...

Which CVE IDs does GHSA-7cf9-xwv8-6722 cover?

GHSA-7cf9-xwv8-6722 covers the following CVE IDs: CVE-2026-90537. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7cf9-xwv8-6722?

GHSA-7cf9-xwv8-6722 has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

GHSA-7cf9-xwv8-6722HighCVSS 8.2

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing...

Vendor

GitHub Security Advisories

Published

September 12, 2026

Last Modified

September 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-90537 →

📋 Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-qq59-3jwp-hgj9
https://nvd.nist.gov/vuln/detail/CVE-2026-90537
https://www.vulncheck.com/advisories/wwbn-avideo-scheduler-sendemail-missing-authorization-via-token
https://github.com/advisories/GHSA-7cf9-xwv8-6722