CVE-2026-50542
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
- Record
CVE-2026-50542- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-112143
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
- Record
EUVD-2026-112143- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
NVD
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
- Record
CVE-2026-50542- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-05
OSV
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
- Record
CVE-2026-50542- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50542 is a medium vulnerability (CVSS 5.4) in Xibosignage Xibo-cms, published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. No source names a fixed version.
References
github.com/xibosignage/xibo-cms/security/advisories/GHSA-wj8r-32gf-6f5f
nvd.nist.gov/vuln/detail/CVE-2026-50542