CVE-2026-50541: Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

Q: Which deployments are realistically exposed?

Xibo versions prior to 4.4.3 are affected, but exploitation requires an authenticated user with the privilege to edit, including delete, all created DataSets independently of Layouts. Non-administrative users do not receive this privilege by default.

Q: What does an attacker need to do to export another dataset?

The attacker needs an authenticated account with the required DataSets privilege and must request the CSV export endpoint using another dataset's ID. Sequential dataset IDs can be iterated to export datasets created by administrators.

Q: What should be done to remediate the issue?

Upgrade Xibo to version 4.4.3, which fixes the missing access-control checks. If upgrading is not immediately possible, restrict the affected DataSets privilege to only trusted accounts.

Published Oct 28, 2026

Updated

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/{id} allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over sequential dataset IDs. Exploitation requires access to the privilege allowing edits, including deletion, to all created DataSets independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.

Affected Software

1 affected component

Xibo Xibo<4.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Xibo to a version that resolves this vulnerability.
Fixed in 4.4.3

Event History

Oct 28, 2026

CVE Published

via MITRE·01:25 PM

Data Sourced

via MITRE·01:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed?

Xibo versions prior to 4.4.3 are affected, but exploitation requires an authenticated user with the privilege to edit, including delete, all created DataSets independently of Layouts. Non-administrative users do not receive this privilege by default.

What does an attacker need to do to export another dataset?

The attacker needs an authenticated account with the required DataSets privilege and must request the CSV export endpoint using another dataset's ID. Sequential dataset IDs can be iterated to export datasets created by administrators.

What should be done to remediate the issue?

Upgrade Xibo to version 4.4.3, which fixes the missing access-control checks. If upgrading is not immediately possible, restrict the affected DataSets privilege to only trusted accounts.

CVE-2026-50541: Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to do to export another dataset?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to do to export another dataset?

What should be done to remediate the issue?