CVE-2026-31956: Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization

Published Apr 24, 2026
·
Updated

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of the vulnerability is possible on behalf of an authorized user who has any of the following privileges: Page which shows all Layouts that have been created for the purposes of Layout Management; page which shows all Campaigns that have been created for the purposes of Campaign Management; and page which shows all Reports that have been Saved. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate.

Affected Software

2 affected components
Xibo Xibo CMS<4.4.1
Xibosignage Xibo<4.4.1

Event History

Apr 24, 2026
CVE Published
via MITRE·12:16 AM
Data Sourced
via MITRE·12:16 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-31956?

CVE-2026-31956 has a moderate severity level due to the potential for unauthorized access to sensitive reports.

2

How do I fix CVE-2026-31956?

To fix CVE-2026-31956, upgrade Xibo CMS to version 4.4.1 or later.

3

What type of vulnerability is CVE-2026-31956?

CVE-2026-31956 is an Insecure Direct Object Reference (IDOR) vulnerability related to user authorization.

4

Who is affected by CVE-2026-31956?

Any authenticated user of Xibo CMS versions prior to 4.4.1 is potentially affected by CVE-2026-31956.

5

What systems are impacted by CVE-2026-31956?

Xibo CMS versions up to, but not including, 4.4.1 are vulnerable to CVE-2026-31956.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203