CVE-2026-52730

Xibo before 4.4.3 lacks authorization on POST /displaygroup/criteria/{displayGroupId}, allowing an authenticated user to send criteria updates to any display via XMR. These criteria affect scheduling and can alter playback. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks access-control checks on GET /layout/status/{id}, allowing an authenticated user with any privileges to view the status and metadata of any layout, including those they do not have view rights to. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks object-level authorization on /notification/export/{id}, allowing an authenticated user to download attachments from any notification, including those created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre, a privilege granted to non-administrators as standard. The issue is fixed in version 4.4.3.

In Xibo prior to 4.4.3, missing access-control checks on PUT/DELETE /action/{id} allow an authenticated user to modify or delete actions on any Layout. Standard privileges granted to non-administrators are sufficient to exploit this.

A vulnerability in Xibo (versions prior to 4.4.3) involves missing access-control checks on the GET /dataset/export/csv/{id} endpoint. An authenticated user can export data from any dataset, including those created by administrators, by iterating over sequential dataset IDs. Exploitation requires the privilege allowing edits and deletion of all datasets, which is not granted to non-administrators by default.

Prior to version 4.4.1, any authenticated Xibo user can manually construct a URL to preview campaigns/regions and export saved reports belonging to other users. Exploitation is possible on behalf of an authorized user with privileges to Layout Management, Campaign Management, or Saved Reports pages. Users should upgrade to version 4.4.1 which fixes this issue.

Xibo prior to version 4.4.1 contains an authenticated SSRF vulnerability that allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external resources. This can be exploited to scan infrastructure, access cloud metadata endpoints (e.g., AWS IMDS), or exfiltrate data.

Xibo (an open source digital signage platform with a web CMS and Windows player) prior to 4.4.1 contains a stored XSS vulnerability. An authenticated user with notification creation permissions can inject arbitrary JavaScript into the notification body. When the notification is set as an "interrupt," the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. This requires Notification Centre access and the "Add Notification" button, which are not granted to non-admins by default. Fixed in 4.4.1.