Object-Level Authorization Flaw in Xibo Digital Signage Platform

CVE-2026-50539

What is CVE-2026-50539?

The Xibo Digital Signage platform is vulnerable due to a missing object-level authorization mechanism on the endpoint /notification/export/{id}. This oversight allows authenticated users to access and download attachments from any notification, including those created by administrators, by sequentially iterating notification IDs. Access to past notifications through the Notification Centre, which is generally available to non-administrators, facilitates this attack. This vulnerability was addressed in version 4.4.3, so users are advised to update to ensure the security of their systems.

References