CVE-2026-100853

AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

8.2 High

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.32%Up 0.1 points since Sep 27, 2026

What each source reports

CVE List Score used 8.2

AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

Record: CVE-2026-100853
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-87835 8.2

Record: EUVD-2026-87835
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j79h-v95g-w786 8.2

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level...

Record: GHSA-j79h-v95g-w786
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 8.2

Record: CVE-2026-100853
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 8.2

AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

Record: CVE-2026-100853
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-862
Updated: 2026-11-02

Affected products

azuracast

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-100853 is a high vulnerability (CVSS 8.2) in Azuracast, published September 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. No source names a fixed version.