CVE-2026-52729
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Xibo prior to 4.4.3, missing access-control checks on PUT/DELETE /action/{id} allow an authenticated user to modify or delete actions on any Layout. Standard privileges granted to non-administrators are sufficient to exploit this.
Risk Assessment
Regular users can modify or delete actions in other users' Layouts, potentially disrupting digital signage content display.
Recommendation
Update Xibo to version 4.4.3 or later, which adds the missing access-control checks for Layout action operations.
Other vulnerabilities in Xibo
See all- CVE-2026-50543Medium
Xibo before 4.4.3 lacks authorization on POST /displaygroup/criteria/{displayGroupId}, allowing an authenticated user to send criteria updates to any display via XMR. These criteria affect scheduling and can alter playback. The issue is fixed in version 4.4.3.
- CVE-2026-50542Medium
Xibo before 4.4.3 lacks access-control checks on GET /layout/status/{id}, allowing an authenticated user with any privileges to view the status and metadata of any layout, including those they do not have view rights to. The issue is fixed in version 4.4.3.
- CVE-2026-50539Medium
Xibo before 4.4.3 lacks object-level authorization on /notification/export/{id}, allowing an authenticated user to download attachments from any notification, including those created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre, a privilege granted to non-administrators as standard. The issue is fixed in version 4.4.3.
- CVE-2026-50541Medium
A vulnerability in Xibo (versions prior to 4.4.3) involves missing access-control checks on the GET /dataset/export/csv/{id} endpoint. An authenticated user can export data from any dataset, including those created by administrators, by iterating over sequential dataset IDs. Exploitation requires the privilege allowing edits and deletion of all datasets, which is not granted to non-administrators by default.
- CVE-2026-52730Medium
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak the full module entity. Exploitation is possible on behalf of an authorized user who has access to the Module View feature, which are not granted to non-admins as standard. Users should upgrade to version 4.4.3 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.
- CVE-2026-31956Medium
Prior to version 4.4.1, any authenticated Xibo user can manually construct a URL to preview campaigns/regions and export saved reports belonging to other users. Exploitation is possible on behalf of an authorized user with privileges to Layout Management, Campaign Management, or Saved Reports pages. Users should upgrade to version 4.4.1 which fixes this issue.
- CVE-2026-31955Medium
Xibo prior to version 4.4.1 contains an authenticated SSRF vulnerability that allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external resources. This can be exploited to scan infrastructure, access cloud metadata endpoints (e.g., AWS IMDS), or exfiltrate data.
- CVE-2026-31953Medium
Xibo (an open source digital signage platform with a web CMS and Windows player) prior to 4.4.1 contains a stored XSS vulnerability. An authenticated user with notification creation permissions can inject arbitrary JavaScript into the notification body. When the notification is set as an "interrupt," the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. This requires Notification Centre access and the "Add Notification" button, which are not granted to non-admins by default. Fixed in 4.4.1.
Original NVD description (English source)
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns `Layout actions` rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS