Access Control Flaw in Xibo Digital Signage Platform

CVE-2026-50541

What is CVE-2026-50541?

Xibo, the open-source digital signage platform, contains a significant access control flaw in its web-based content management system prior to version 4.4.3. This vulnerability arises from inadequate access-control checks, specifically on the GET /dataset/export/csv/{id} endpoint, allowing authenticated users to maliciously export sensitive data from any dataset, including those restricted to administrative use. Given the ability to iterate over sequential dataset IDs, an attacker with the appropriate privileges could gain unauthorized access to data meant solely for administrative roles. This issue underscores the importance of stringent access control measures and has been rectified in version 4.4.3.

References