CVE-2026-50542 in xibo-cms
Summary
by MITRE • 10/28/2026
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /layout/status/{id}` allow an authenticated user with any privileges to view the `status and metadata` of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Xibo versions prior to 4.4.3 represents a critical failure in access control mechanisms within its web content management system. Specifically, the endpoint GET /layout/status/{id} lacks proper authorization checks, allowing any authenticated user to retrieve status and metadata for layouts regardless of their assigned permissions. This flaw enables users with minimal privileges to view sensitive information about layouts they are not authorized to see, potentially exposing internal operational details or proprietary content structures.
From a technical perspective, this issue stems from insufficient validation of the requesting user's rights against the resource being accessed. The application fails to verify whether the authenticated session has explicit permission to access the specific layout identified by its ID parameter. As a result, even users with basic viewing privileges can bypass intended restrictions and extract data that should be restricted based on role-based access control policies. This type of vulnerability is commonly categorized under CWE-284 Improper Access Control, where an application does not adequately restrict actions or information to authorized entities.
The operational impact of this flaw includes potential exposure of layout configurations, scheduling details, and other metadata that could aid attackers in further reconnaissance activities. While the immediate risk may seem limited since it requires authentication, the ability to enumerate layouts without proper authorization can facilitate more sophisticated attacks such as targeted social engineering or exploitation of related vulnerabilities within those specific layouts. Additionally, this behavior violates principles outlined in industry standards like OWASP Access Control Cheat Sheet which emphasize strict enforcement of access controls on all server-side functions.
To mitigate this vulnerability organizations should upgrade immediately to version 4.4.3 where the issue has been resolved through enhanced authorization checks implemented at both application and database levels ensuring that only users with appropriate permissions can query layout status information. For environments unable to patch promptly implementing additional network-level protections such as web application firewalls configured to detect anomalous access patterns may provide temporary relief while monitoring logs for unusual activity related to this endpoint remains advisable until full remediation occurs