Live › vulnerability › CVE-2026-50543
Go to dashboardXibo is an open source digital signage platform. Before 4.4.3, an authenticated user can send criteria updates to any display through XMR, changing which content plays, for example swapping in weather-based content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Self-hosted Xibo CMS instances before 4.4.3 that use Schedule Criteria. An attacker needs a valid account on the CMS; without Schedule Criteria in use the sources say the issue does not apply. Managed Xibo hosting is handled by the vendor.
No product ranges from the sources yet.
4.4.3.Schedule Criteria is in use on the CMS (unknown how to query this from the sources).4.4.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing authorization on POST /displaygroup/criteria/{displayGroupId} allows an authenticated user to send criteria updates to any display via XMR. These criteria determine schedule changes and can alter playback, for example by causing content scheduled for rainy weather to play when it is not raining. Exploitation requires Schedule Criteria to be in use on the CMS. This issue is fixed in version 4.4.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-50543")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.