GHSA-p4pg-v57g-7jf6: Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Published Oct 28, 2026

Updated

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/{id} allows an authenticated user to download attachments from any notification, including notifications created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre to view past notifications, a privilege granted to non-administrators as standard. This issue is fixed in version 4.4.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Xibo to a version that resolves this vulnerability.
Fixed in 4.4.3

Event History

Oct 28, 2026

CVE Published

via OSV·03:31 PM

Data Sourced

via OSV·03:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are realistically able to exploit this issue?

Any authenticated user with access to the Notification Centre can exploit it. That access is granted to non-administrators as standard.

What does an attacker need to do to access another notification's attachment?

The attacker must be authenticated and able to view past notifications in the Notification Centre. They can then iterate sequential notification IDs in the export endpoint to download attachments from notifications they do not own, including administrator-created notifications.

Are default non-administrator accounts affected?

Yes. The required Notification Centre privilege is granted to non-administrators as standard, so deployments using the standard privilege assignment are exposed.

How can I determine whether my deployment is vulnerable?

Xibo versions prior to 4.4.3 are affected. Affected users can test whether a non-administrator with Notification Centre access can request the export endpoint using an ID for a notification created by another user.

What should be done if upgrading cannot happen immediately?

The provided information does not specify a workaround. Restricting access to the Notification Centre for non-administrative users may reduce exposure, since that access is required for exploitation.

GHSA-p4pg-v57g-7jf6: Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Remediation

Event History

Frequently Asked Questions

Which users are realistically able to exploit this issue?

What does an attacker need to do to access another notification's attachment?

Are default non-administrator accounts affected?

How can I determine whether my deployment is vulnerable?

What should be done if upgrading cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which users are realistically able to exploit this issue?

What does an attacker need to do to access another notification's attachment?

Are default non-administrator accounts affected?

How can I determine whether my deployment is vulnerable?

What should be done if upgrading cannot happen immediately?