Live › vulnerability › CVE-2026-50541
Go to dashboardXibo's digital signage web CMS lets any authenticated user export any dataset as CSV by iterating sequential dataset IDs, because the export endpoint lacks access-control checks. An attacker who holds dataset edit rights can read data from datasets created by administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Self-hosted or managed Xibo CMS installations before 4.4.3 where some non-administrator users hold the privilege to edit or delete DataSets independently of Layouts. The sources say this privilege is not granted to non-administrators by default, so default installs are less exposed. Teams not running Xibo can skip this.
No product ranges from the sources yet.
4.4.3 are affected.4.4.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/{id} allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over sequential dataset IDs. Exploitation requires access to the privilege allowing edits, including deletion, to all created DataSets independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-50541")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.