Authorization Flaw in Xibo Digital Signage Platform Exposes Module Settings

CVE-2026-52730

What is CVE-2026-52730?

Xibo, an open-source digital signage solution, has an authorization flaw in its Module::settingsForm. This vulnerability enables an authorized user—with access to the Module View feature—to view super admin-restricted module settings, which potentially discloses sensitive information. While this issue does not permit modifications, it allows the exposure of the full module entity. Users are recommended to upgrade to version 4.4.3 to mitigate this risk effectively. For those unable to upgrade, it is crucial to reevaluate the privileges of users and restrict access to trustworthy individuals only.

References