Live › vulnerability › CVE-2026-121430
AzuraCast before 0.24.0 has GET and POST routes for station waveform data that skip the permission check. Any logged-in user without a station assignment can read another station's cached waveform data and overwrite it with their own content, corrupting Visual Cue Editor data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running AzuraCast, a self-hosted radio station platform, before 0.24.0 where more than one user account exists. Users assigned to a station are not the attack path; any authenticated user without a station assignment is. Installs with only trusted, station-assigned accounts have less exposure.
No product ranges from the sources yet.
0.24.0 are affected./api/station/{station_id}/waveform/{media_id} in the running install for the Permissions middleware (unknown if the sources give a specific file).0.24.0 or later, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.
This page as .md · .json · in your agent: get_signal("CVE-2026-121430")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.