CVE-2026-50542: Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xiboto a version that resolves this vulnerability.Fixed in 4.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Xibo user can exploit it, including a user with low privileges. The attacker only needs to request the status endpoint with the ID of a layout they are not authorized to view.
Are unauthenticated or default deployments exposed?
Unauthenticated access is not described as affected; exploitation requires an authenticated account. The available information does not state whether a default configuration creates or restricts vulnerable user accounts.
Which versions need remediation?
Xibo versions before 4.4.3 are affected. Upgrade to version 4.4.3 or later to obtain the access-control fix.
What information could be exposed?
An attacker can view status and metadata for arbitrary layouts, including layouts for which their account lacks view permission. The provided information does not indicate that layout content can be modified or deleted.