{"id":"CVE-2026-121427","kind":"vulnerability","aliases":["CVE-2026-121427"],"related":[],"title":"AzuraCast: station profile users can hijack Shoutcast frontend config","description":"AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.","summary":"AzuraCast through 0.23.8 does not strip a custom Shoutcast config field for users who lack broadcasting permission, and writes it verbatim into the Shoutcast sc_serv.conf file. A user with only the station profile permission can override the admin and source passwords and the port, or inject extra directives through newlines, taking over the station's Shoutcast frontend.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azuracast","package","radio","self-hosted","shoutcast"],"not_affected_if":["admin-only-profile-edits"],"how_to_check":"- Check the AzuraCast version with `docker exec -it azuracast azuracast_cli --version` or the admin panel footer; unknown if the sources do not give the exact command.\n- Look for the `frontend_config.custom_config` field in station profile settings for non-admin users.\n- Review `sc_serv.conf` for unexpected `adminpassword`, `password` or `portbase` lines.","fix":"- AzuraCast: versions after `0.23.8` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-03T15:17:33+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","triaged_at":"2026-11-03T15:22:36+00:00","updated_at":"2026-11-03T15:22:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T15:22:36Z","model":"claude-haiku-5-5","output":{"fix":"- AzuraCast: versions after `0.23.8` are affected; the sources do not name a fixed version.","reach":"network","title":"AzuraCast: station profile users can hijack Shoutcast frontend config","impact":"high","summary":"AzuraCast through 0.23.8 does not strip a custom Shoutcast config field for users who lack broadcasting permission, and writes it verbatim into the Shoutcast sc_serv.conf file. A user with only the station profile permission can override the admin and source passwords and the port, or inject extra directives through newlines, taking over the station's Shoutcast frontend.","audience":"businesses","category":"package","nicknames":[],"who_cares":["azuracast","self-hosted","shoutcast","radio"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker takes over station streaming frontend and its passwords","analyst_note":"Confirm the fixed AzuraCast version and the vendor advisory at github.com linked in the sources.","how_to_check":"- Check the AzuraCast version with `docker exec -it azuracast azuracast_cli --version` or the admin panel footer; unknown if the sources do not give the exact command.\n- Look for the `frontend_config.custom_config` field in station profile settings for non-admin users.\n- Review `sc_serv.conf` for unexpected `adminpassword`, `password` or `portbase` lines.","plain_action":"","needs_analyst":true,"not_affected_if":["admin-only-profile-edits"],"who_is_affected":"Teams running self-hosted AzuraCast with station users who hold only the Manage station profile permission can be affected. Installations where only fully trusted administrators can edit station profiles are less exposed. The sources do not state a fixed release.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4241,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121427':12A,15A '-2026':11A,14A '/profile/edit':92C '/station':90C '0.23.8':25B,82C 'admin':60B 'adminpassword':129C 'arbitrari':135C 'authent':118C 'azuracast':1A,16B,23B,80C 'broadcast':38B,99C 'config':9A,32B,87C 'custom':30B 'cve':10A,13A 'direct':70B,136C 'extra':69B 'fail':83C 'field':33B 'file':48B,116C 'frontend':8A,79B,146C 'frontend_config.custom':86C 'hijack':6A,141C 'host':21B 'id':91C 'inject':68B,134C 'json':104C 'key':109C,140C 'lack':37B,95C 'line':111C 'manag':97C,123C 'newlin':72B,138C 'overrid':58B,128C 'packag':17B 'password':63B,130C 'permiss':39B,56B,100C,126C 'port':66B 'portbas':132C 'profil':3A,55B,125C 'put':89C 'radio':18B 'remov':85C 'sc_serv.conf':47B,115C 'self':20B 'self-host':19B 'shoutcast':7A,22B,31B,46B,78B,114C,145C 'sourc':62B 'station':2A,54B,76B,98C,124C,143C 'store':103C 'strip':28B 'take':73B 'user':4A,35B,50B,94C,119C 'valu':110C 'verbatim':43B,107C 'via':137C 'write':41B 'written':106C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted AzuraCast with station users who hold only the Manage station profile permission can be affected. Installations where only fully trusted administrators can edit station profiles are less exposed. The sources do not state a fixed release.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azuracast","high","package","radio","selfhosted","shoutcast"],"first_public_at":"2026-10-18T17:16:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121427","severity":null,"published_at":"2026-11-03T15:17:33+00:00","modified_at":"2026-11-03T15:17:33+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","fetched_at":"2026-11-03T15:21:59+00:00","note":null}],"documents":[{"id":58379,"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-2wcv-vv3g-g86q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-18T17:16:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58380,"url":"https://www.vulncheck.com/advisories/azuracast-through-0.23.8-config-injection-via-frontend-config-custom-config","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}