CVE-2026-50541
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Xibo (versions prior to 4.4.3) involves missing access-control checks on the GET /dataset/export/csv/{id} endpoint. An authenticated user can export data from any dataset, including those created by administrators, by iterating over sequential dataset IDs. Exploitation requires the privilege allowing edits and deletion of all datasets, which is not granted to non-administrators by default.
Risk Assessment
The organization may experience unauthorized data leakage from datasets, including sensitive information created by administrators. This can lead to confidentiality breaches and compliance implications.
Recommendation
Update Xibo to version 4.4.3 or later. Additionally, review and restrict privileges for editing and deleting datasets to trusted administrators only.
Other vulnerabilities in Xibo
See all- CVE-2026-50543Medium
Xibo before 4.4.3 lacks authorization on POST /displaygroup/criteria/{displayGroupId}, allowing an authenticated user to send criteria updates to any display via XMR. These criteria affect scheduling and can alter playback. The issue is fixed in version 4.4.3.
- CVE-2026-50542Medium
Xibo before 4.4.3 lacks access-control checks on GET /layout/status/{id}, allowing an authenticated user with any privileges to view the status and metadata of any layout, including those they do not have view rights to. The issue is fixed in version 4.4.3.
- CVE-2026-50539Medium
Xibo before 4.4.3 lacks object-level authorization on /notification/export/{id}, allowing an authenticated user to download attachments from any notification, including those created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre, a privilege granted to non-administrators as standard. The issue is fixed in version 4.4.3.
- CVE-2026-52729High
In Xibo prior to 4.4.3, missing access-control checks on PUT/DELETE /action/{id} allow an authenticated user to modify or delete actions on any Layout. Standard privileges granted to non-administrators are sufficient to exploit this.
- CVE-2026-52730Medium
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak the full module entity. Exploitation is possible on behalf of an authorized user who has access to the Module View feature, which are not granted to non-admins as standard. Users should upgrade to version 4.4.3 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.
- CVE-2026-31956Medium
Prior to version 4.4.1, any authenticated Xibo user can manually construct a URL to preview campaigns/regions and export saved reports belonging to other users. Exploitation is possible on behalf of an authorized user with privileges to Layout Management, Campaign Management, or Saved Reports pages. Users should upgrade to version 4.4.1 which fixes this issue.
- CVE-2026-31955Medium
Xibo prior to version 4.4.1 contains an authenticated SSRF vulnerability that allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external resources. This can be exploited to scan infrastructure, access cloud metadata endpoints (e.g., AWS IMDS), or exfiltrate data.
- CVE-2026-31953Medium
Xibo (an open source digital signage platform with a web CMS and Windows player) prior to 4.4.1 contains a stored XSS vulnerability. An authenticated user with notification creation permissions can inject arbitrary JavaScript into the notification body. When the notification is set as an "interrupt," the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. This requires Notification Centre access and the "Add Notification" button, which are not granted to non-admins by default. Fixed in 4.4.1.
Original NVD description (English source)
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS