CVE-2026-100847: AzuraCast before 0.23.8 DQL Injection via sortOrder
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
AzuraCast versions before 0.23.8 are affected. Version 0.23.8 is the stated fixed-version boundary.
What access does an attacker need?
The vulnerability is network-accessible and requires no privileges or user interaction. An attacker needs to be able to send requests containing a crafted sortOrder API parameter.
What could an attacker obtain?
A successful attack can inject arbitrary DQL expressions to extract sensitive database information, including user credentials and station settings. The provided data indicates confidentiality impact, not integrity or availability impact.