Live › vulnerability › CVE-2026-50539
Go to dashboardXibo digital signage platform before 4.4.3 lacks an object-level authorization check on the notification export endpoint. An authenticated non-admin user can iterate sequential notification IDs and download attachments from any notification, including ones created by administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Self-hosted or managed Xibo CMS instances running versions before 4.4.3 that have non-administrator user accounts with access to the Notification Centre. Exposure requires an authenticated account, so instances without user accounts beyond administrators are less exposed. unknown whether managed hosting by the vendor has already been patched.
No product ranges from the sources yet.
4.4.3 are affected.4.4.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/{id} allows an authenticated user to download attachments from any notification, including notifications created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre to view past notifications, a privilege granted to non-administrators as standard. This issue is fixed in version 4.4.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-50539")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.