5.4
MediumCVSS 3.1 · from GitHub_M
CVE-2026-50542
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
xibo-cms · Missing authorization · CWE-862Affectedxibo-cms
FixNo fix listed yet.
PublishedOct 28, 15:34 · GitHub_M
ScoredOct 28 · 5.4 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /layout/status/{id}` allow an authenticated user with any privileges to view the `status and metadata` of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inxibo-cms< 4.4.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known