CVE-2026-31956

Xibo before 4.4.3 lacks authorization on POST /displaygroup/criteria/{displayGroupId}, allowing an authenticated user to send criteria updates to any display via XMR. These criteria affect scheduling and can alter playback. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks access-control checks on GET /layout/status/{id}, allowing an authenticated user with any privileges to view the status and metadata of any layout, including those they do not have view rights to. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks object-level authorization on /notification/export/{id}, allowing an authenticated user to download attachments from any notification, including those created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre, a privilege granted to non-administrators as standard. The issue is fixed in version 4.4.3.

In Xibo prior to 4.4.3, missing access-control checks on PUT/DELETE /action/{id} allow an authenticated user to modify or delete actions on any Layout. Standard privileges granted to non-administrators are sufficient to exploit this.

A vulnerability in Xibo (versions prior to 4.4.3) involves missing access-control checks on the GET /dataset/export/csv/{id} endpoint. An authenticated user can export data from any dataset, including those created by administrators, by iterating over sequential dataset IDs. Exploitation requires the privilege allowing edits and deletion of all datasets, which is not granted to non-administrators by default.

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak the full module entity. Exploitation is possible on behalf of an authorized user who has access to the Module View feature, which are not granted to non-admins as standard. Users should upgrade to version 4.4.3 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.

Xibo prior to version 4.4.1 contains an authenticated SSRF vulnerability that allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external resources. This can be exploited to scan infrastructure, access cloud metadata endpoints (e.g., AWS IMDS), or exfiltrate data.

Xibo (an open source digital signage platform with a web CMS and Windows player) prior to 4.4.1 contains a stored XSS vulnerability. An authenticated user with notification creation permissions can inject arbitrary JavaScript into the notification body. When the notification is set as an "interrupt," the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. This requires Notification Centre access and the "Add Notification" button, which are not granted to non-admins by default. Fixed in 4.4.1.