Authorization Flaw in Xibo Digital Signage Platform

CVE-2026-50543

What is CVE-2026-50543?

The Xibo digital signage platform suffers from a significant security issue due to a lack of proper authorization in the endpoint that handles display group criteria updates. An authenticated user can exploit this vulnerability by sending unauthorized updates through the Xibo Message Router (XMR). This manipulation allows them to change display schedules, leading to improper content being played, such as triggering messages for weather conditions that do not match. The problem is particularly concerning for installations utilizing 'Schedule Criteria' functionality. The issue has been resolved in version 4.4.3 of the software.

References