WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests. Commit 83390ab1fa8dca2de3f8fa76116a126428405431 contains a patch.

Affected: Packagist: wwbn/avideo

## Summary

Three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests.

## Details

The vulnerable files are:

**1. `plugin/Scheduler/View/Scheduler_commands/list.json.php:1-7`** ```php <?php require_once '../../../../videos/configuration.php'; require_once $global['systemRootPath'] . 'plugin/Scheduler/Objects/Scheduler_commands.php'; header('Content-Type: application/json');

$rows = Scheduler_commands::getAll(); ?> {"data": <?php echo json_encode($rows); ?>} ```

**2. `plugin/Scheduler/View/Emails_messages/list.json.php:1-10`** ```php <?php require_once '../../../../videos/configuration.php'; require_once $global['systemRootPath'] . 'plugin/Scheduler/Objects/Emails_messages.php'; header('Content-Type: application/json');

$rows = Emails_messages::getAll(); $total = Emails_messages::getTotal(); ?> {"data": <?php echo json_encode($rows); ?>, ...} ```

**3. `plugin/Scheduler/View/Email_to_user/list.json.php:1-10`** ```php <?php require_once '../../../../videos/configuration.php'; require_once $global['systemRootPath'] . 'plugin/Scheduler/Objects/Email_to_user.php'; header('Content-Type: application/json');…