Liquidsoap Configuration Exposure in AzuraCast by Vendor AzuraCast

CVE-2026-76836

What is CVE-2026-76836?

AzuraCast exposes sensitive Liquidsoap custom configuration fields without enforcing strict permission controls, allowing unauthorized users to write configuration changes. The vulnerable endpoint improperly validates permissions, enabling users with minimal access rights to modify critical aspects of Liquidsoap scripts. This can potentially lead to execution of arbitrary operating system commands upon backend restarts, posing a significant security risk.

References