GHSA-wj8r-32gf-6f5f: Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

Published Oct 28, 2026

Updated

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Xibo to a version that resolves this vulnerability.
Fixed in 4.4.3

Event History

Oct 28, 2026

CVE Published

via OSV·03:34 PM

Data Sourced

via OSV·03:34 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Xibo user can exploit it, including users with privileges that do not grant them view rights to the targeted layout. The attacker needs network access to the affected Xibo CMS endpoint and a valid account.

What information can be exposed?

An attacker can retrieve the status and metadata of arbitrary layouts through the layout status endpoint. The issue does not indicate that layout contents can be modified or deleted.

Are deployments affected by default?

The issue affects Xibo CMS versions before 4.4.3 because the endpoint lacks the required access-control checks. No special configuration or user interaction is described as necessary beyond authentication.

What should teams do if they cannot upgrade immediately?

The provided information does not specify a workaround. Restrict access to authenticated CMS accounts and review which users have accounts, since any authenticated privilege level may be sufficient to access unauthorized layout metadata.

How can defenders identify potential exposure?

Review requests to GET /layout/status/{id}, particularly where a user accesses layout IDs for layouts they are not authorized to view. Systems running a version earlier than 4.4.3 should be treated as affected.

GHSA-wj8r-32gf-6f5f: Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are deployments affected by default?

What should teams do if they cannot upgrade immediately?

How can defenders identify potential exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are deployments affected by default?

What should teams do if they cannot upgrade immediately?

How can defenders identify potential exposure?