Live › vulnerability › CVE-2026-52729
Go to dashboardXibo is an open source digital signage platform whose web CMS lacks access-control checks on the PUT and DELETE /action/{id} endpoints. An authenticated user can modify or delete layout actions on any layout, not just their own.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Teams running a self-hosted Xibo CMS older than 4.4.3 with non-administrator users who have layout edit or delete rights. The sources describe this as the standard grant for non-administrators, so most multi-user installs fall in scope. The separately reported DataSet export issue is not covered by this entry.
No product ranges from the sources yet.
4.4.3 are affected.4.4.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on PUT/DELETE /action/{id} allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns Layout actions rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-52729")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.