Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on PUT/DELETE /action/{id} allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns Layout actions rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…bo-cms/security/advisories/GHSA-7j3h-48f7-w4fr Diğer
• github.com/xibosignage/xibo-cms/pull/3492 Diğer
• github.com/…ommit/96d7b458781b8cd10e64788565fbdeffd15f08cf Diğer
• github.com/…ommit/efd13abf868e2386f40929ed6e4f36fead310f20 Diğer
• github.com/xibosignage/xibo-cms/releases/tag/4.4.3 Diğer
• github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta Diğer

Kayıt geçmişi

1. 28 Eki 2026 16:23Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-50541Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
• 8,5 CVE-2026-59185identrail: Cross-tenant GitHub installation binding without ownership verification
• 7,1 CVE-2026-59164NORA missing cross-user token-management authorization
• 7,5 CVE-2026-116393WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
• 6,5 CVE-2026-116404WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability
• 5,4 CVE-2026-116855WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability