{"id":"CVE-2026-50541","kind":"vulnerability","aliases":["CVE-2026-50541"],"related":[],"title":"Xibo: dataset CSV export skips access checks, leaking admin-created datasets","description":"Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.","summary":"Xibo's digital signage web CMS lets any authenticated user export any dataset as CSV by iterating sequential dataset IDs, because the export endpoint lacks access-control checks. An attacker who holds dataset edit rights can read data from datasets created by administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["digital-signage","package","self-hosted","xibo"],"not_affected_if":["default-config","xibo-4.4.3-or-later"],"how_to_check":"- Check the installed Xibo CMS version in the admin UI or the release files; versions below `4.4.3` are affected.\n- Review which users hold dataset edit or delete permissions across all datasets.","fix":"- Upgrade Xibo CMS to `4.4.3` or later.\n- Until upgraded, restrict dataset edit permissions to trusted users only.","status":"open","published_at":"2026-10-28T14:17:03+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","triaged_at":"2026-10-28T14:34:30+00:00","updated_at":"2026-10-28T14:34:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T14:34:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Xibo CMS to `4.4.3` or later.\n- Until upgraded, restrict dataset edit permissions to trusted users only.","reach":"network","title":"Xibo: dataset CSV export skips access checks, leaking admin-created datasets","impact":"medium","summary":"Xibo's digital signage web CMS lets any authenticated user export any dataset as CSV by iterating sequential dataset IDs, because the export endpoint lacks access-control checks. An attacker who holds dataset edit rights can read data from datasets created by administrators.","category":"package","nicknames":[],"who_cares":["xibo","self-hosted","digital-signage"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated user reads data from any dataset, including admin-created ones.","analyst_note":"","how_to_check":"- Check the installed Xibo CMS version in the admin UI or the release files; versions below `4.4.3` are affected.\n- Review which users hold dataset edit or delete permissions across all datasets.","needs_analyst":false,"not_affected_if":["default-config","xibo-4.4.3-or-later"],"who_is_affected":"Self-hosted or managed Xibo CMS installations before 4.4.3 where some non-administrator users hold the privilege to edit or delete DataSets independently of Layouts. The sources say this privilege is not granted to non-administrators by default, so default installs are less exposed. Teams not running Xibo can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":3390,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-50541':15A,18A '/dataset/export/csv':100C '4.4.3':92C,157C 'access':6A,53B,95C,125C 'access-control':52B,94C 'admin':10A 'admin-cr':9A 'administr':70B,116C,148C 'allow':102C,129C 'attack':57B 'authent':35B,104C 'check':7A,55B,97C 'cms':32B 'content':82C 'control':54B,96C 'creat':11A,68B,114C,135C 'csv':3A,41B 'cve':13A,16A 'data':65B,108C 'dataset':2A,12A,39B,45B,60B,67B,111C,113C,121C,136C 'delet':132C 'digit':20B,29B,76C 'digital-signag':19B 'display':87C 'edit':61B,130C 'endpoint':50B 'exploit':123C 'export':4A,37B,49B,107C 'fix':154C 'get':99C 'grant':144C 'hold':59B 'host':25B 'id':46B,101C,122C 'includ':112C,131C 'independ':137C 'issu':152C 'iter':43B,118C 'lack':51B 'layout':139C 'leak':8A 'let':33B 'manag':83C 'miss':93C 'non':147C 'non-administr':146C 'open':74C 'packag':22B 'platform':78C 'player':88C 'prior':90C 'privileg':128C,141C 'read':64B 'requir':124C 'right':62B 'self':24B 'self-host':23B 'sequenti':44B,120C 'signag':21B,30B,77C 'skip':5A 'softwar':89C 'sourc':75C 'standard':150C 'system':84C 'user':36B,105C 'version':156C 'web':31B,81C 'window':86C 'xibo':1A,26B,27B,71C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Xibo CMS installations before 4.4.3 where some non-administrator users hold the privilege to edit or delete DataSets independently of Layouts. The sources say this privilege is not granted to non-administrators by default, so default installs are less exposed. Teams not running Xibo can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50541","severity":null,"published_at":"2026-10-28T14:17:03+00:00","modified_at":"2026-10-28T14:17:03+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","fetched_at":"2026-10-28T14:33:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}