Access Control Vulnerability in Xibo Digital Signage Platform
CVE-2026-50542

5.4MEDIUM

Key Information:

Vendor

Xibosignage

Status
Xibo-cms
Vendor
CVE Published:
28 October 2026

What is CVE-2026-50542?

Xibo, an open-source digital signage platform, has an access control vulnerability allowing authenticated users to access status and metadata of layouts without proper permissions. This flaw exists in versions prior to 4.4.3, where missing verification on the GET request for layout status can expose sensitive information that users should not have access to. Users are advised to upgrade to version 4.4.3 or later to mitigate this security risk.

Affected Version(s)

xibo-cms < 4.4.3

References

https://github.com/xibosignage/xibo-cms/security/advisori...
x_refsource_CONFIRM
https://github.com/xibosignage/xibo-cms/pull/3481
x_refsource_MISC
https://github.com/xibosignage/xibo-cms/commit/610f0ecbfd...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.