CVE-2026-76836 in AzuraCast
Summary
by MITRE • 08/24/2026
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in AzuraCast represents a critical authorization bypass within its API infrastructure, specifically targeting the Liquidsoap custom configuration subsystem. The core of this issue lies in an inconsistency between the declared security groups and the actual enforcement mechanisms applied during data deserialization. In the backend entity model, the station properties related to Liquidsoap configurations are annotated with GROUP_GENERAL, which is intended for broader access but was incorrectly mapped to a less privileged permission scope in the API controller logic. The ProfileEditController handles requests at the endpoint PUT /api/station/{station_id}/profile/edit and requires only StationPermissions::Profile, a role typically reserved for basic station management tasks such as editing metadata or scheduling information rather than modifying low-level audio processing configurations.
The technical flaw manifests during the deserialization process where AbstractArrayEntity::fromArray() is invoked to map incoming JSON data onto the entity object. This method assigns every public property without performing field-level permission checks, relying instead on the group annotation defined in the entity class. Because the Liquidsoap configuration fields were incorrectly associated with GROUP_GENERAL rather than a more restrictive group like BROADCASTING or ADMIN, they became accessible through any endpoint that utilizes this deserialization path and requires only basic profile permissions. This design oversight allows an attacker possessing merely StationPermissions::Profile to write arbitrary values into sensitive configuration properties including custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade, and custom_config_bottom.
The operational impact of this vulnerability is severe due to the subsequent processing of these configurations by the Liquidsoap audio streaming engine. When a station restarts or when the backend sync task triggers an automatic restart because needs_restart has been set, the ConfigWriter::writeCustomConfigurationSection() method writes the user-supplied values verbatim into the generated .liq script files. These scripts are executed by the Liquidsoap process, which supports built-in functions such as process.run and process.exec that directly invoke operating system commands. Consequently, an attacker can inject malicious shell code through these configuration fields, leading to remote command execution on the server hosting AzuraCast with the privileges of the user running the backend service.
This vulnerability aligns closely with CWE-284 Improper Access Control, as it involves a failure to enforce proper authorization levels for specific resources within an application layer API. Furthermore, from the perspective of the MITRE ATT&CK framework, this flaw facilitates Initial Access and Execution tactics by allowing unauthorized users to execute arbitrary commands on the target system through configuration manipulation rather than direct exploitation of code execution vulnerabilities in the web server itself. The existence of a dedicated endpoint PUT /api/station/{id}/liquidsoap-config that correctly requires StationPermissions::Broadcasting highlights that the security boundary was intended but improperly implemented in the profile editing route, creating an unintended privilege escalation path for station managers with limited roles.
Mitigation strategies must focus on correcting the permission mapping within the API controllers and enforcing strict field-level authorization checks during deserialization. Developers should ensure that any endpoint modifying sensitive configuration data requires appropriate high-privilege permissions such as Broadcasting or Admin rather than generic profile access. Additionally, implementing a whitelist-based validation for Liquidsoap configuration inputs can prevent the injection of dangerous functions like process.run or process.exec even if an attacker manages to bypass permission checks. Regular security audits of API endpoints against their intended privilege levels are essential to maintain robust access control boundaries in complex radio broadcasting software stacks.