CVE-2026-50541 in Xibo CMS
Summary
by MITRE • 10/28/2026
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
Xibo serves as a prominent open-source digital signage solution that combines a web-based content management system with dedicated Windows display player software, enabling organizations to manage and distribute multimedia content across multiple screens. The platform relies on role-based access control mechanisms to ensure that users can only interact with resources appropriate to their assigned privileges. However, in versions prior to 4.4.3, the application exhibited a critical flaw within its data export functionality, specifically targeting the endpoint responsible for exporting dataset contents to CSV format via GET requests at /dataset/export/csv/{id}. This vulnerability stems from an insufficient access-control check that fails to validate whether the authenticated user initiating the request owns or has explicit permission to access the specific dataset identified by the provided ID.
The technical nature of this flaw constitutes a Broken Access Control issue, aligning with CWE-284 in the Common Weakness Enumeration taxonomy. The vulnerability allows an attacker who possesses valid credentials and basic editing privileges for datasets to bypass intended security restrictions. By systematically iterating through sequential integer values assigned as dataset identifiers, an authenticated user can enumerate and subsequently export data from any dataset within the system. This includes sensitive information contained in datasets created by administrators or other high-privilege users, effectively circumventing the isolation boundaries established between different user roles. The exploitation does not require complex injection techniques or remote code execution vectors; rather, it relies on simple enumeration of resource identifiers combined with a lack of server-side authorization verification for each individual request.
From an operational perspective, this vulnerability poses significant risks to data confidentiality and integrity within digital signage deployments. Since the exported CSV files can contain any content stored in the targeted datasets, attackers could exfiltrate proprietary business information, customer details, or internal configuration settings that were not intended for general staff access. Although standard non-administrative users are typically granted permissions limited to editing specific layouts rather than all created datasets, this assumption is undermined by the flaw if a user happens to hold broader dataset management privileges. The ability to export arbitrary data could facilitate further attacks such as social engineering campaigns using harvested information or provide insights into system architecture that aid in more sophisticated intrusions. This behavior also maps to ATT&CK technique T1087, which involves account discovery and enumeration of organizational accounts through API endpoints.
The issue was addressed in version 4.4.3 by implementing strict authorization checks on the export endpoint. The fix ensures that before any data is exported, the system verifies that the requesting user has explicit permission to access the specific dataset identified in the URL parameter. This correction reinforces the principle of least privilege and prevents unauthorized enumeration or extraction of sensitive records. Organizations running older versions of Xibo should prioritize upgrading to version 4.4.3 or later to mitigate this risk. In addition to patching, administrators should review user roles and permissions to ensure that dataset editing rights are granted only to those who strictly require them for their job functions. Regular security audits and monitoring of API access logs can also help detect any attempts at unauthorized data enumeration before they result in significant information disclosure.