CVE-2026-50541

CVE-2026-50541 · Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.

CVSS 6.5 · Moyenne · EPSS 0,4%

Publication

2026-10-28T13:25:10.271Z

Mise à jour

2026-10-28T13:25:10.271Z

Vérifiez votre serveur →