{"id":"CVE-2026-52729","kind":"vulnerability","aliases":["CVE-2026-52729"],"related":[],"title":"Xibo: authenticated users can edit or delete any layout's actions","description":"Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns `Layout actions` rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.","summary":"Xibo is an open source digital signage platform whose web CMS lacks access-control checks on the PUT and DELETE /action/{id} endpoints. An authenticated user can modify or delete layout actions on any layout, not just their own.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["digital-signage","package","self-hosted","xibo"],"not_affected_if":["patched-4.4.3-or-later","single-admin-only"],"how_to_check":"- Check the installed Xibo CMS version; the sources say versions before `4.4.3` are affected.\n- Review which non-administrator users have edit or delete rights on layouts.","fix":"- Upgrade the Xibo CMS to `4.4.3` or later.","status":"open","published_at":"2026-10-28T14:17:04+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","triaged_at":"2026-10-28T14:34:30+00:00","updated_at":"2026-10-28T14:34:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T14:34:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Xibo CMS to `4.4.3` or later.","reach":"network","title":"Xibo: authenticated users can edit or delete any layout's actions","impact":"medium","summary":"Xibo is an open source digital signage platform whose web CMS lacks access-control checks on the PUT and DELETE /action/{id} endpoints. An authenticated user can modify or delete layout actions on any layout, not just their own.","category":"package","nicknames":[],"who_cares":["self-hosted","digital-signage","xibo"],"confidence":0.7,"needs_auth":"yes","worst_case":"authenticated user alters or deletes layout actions across all layouts","analyst_note":"","how_to_check":"- Check the installed Xibo CMS version; the sources say versions before `4.4.3` are affected.\n- Review which non-administrator users have edit or delete rights on layouts.","needs_analyst":false,"not_affected_if":["single-admin-only","patched-4.4.3-or-later"],"who_is_affected":"Teams running a self-hosted Xibo CMS older than 4.4.3 with non-administrator users who have layout edit or delete rights. The sources describe this as the standard grant for non-administrators, so most multi-user installs fall in scope. The separately reported DataSet export issue is not covered by this entry.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000583,"input_tokens":3383,"output_tokens":490,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-52729':14A,17A '/action':47B,91C '4.4.3':83C,146C 'access':39B,86C 'access-control':38B,85C 'action':11A,58B,101C,131C 'administr':124C 'allow':93C,110C 'authent':2A,51B,95C 'check':41B,88C 'cms':36B 'concern':129C 'content':73C 'control':40B,87C 'creat':116C 'cve':12A,15A 'dataset':137C 'delet':7A,46B,56B,100C,113C 'digit':19B,31B,67C 'digital-signag':18B 'display':78C 'edit':5A,111C 'endpoint':49B 'exploit':105C 'export':138C 'fix':143C 'grant':120C 'host':24B 'id':48B,92C 'includ':112C 'issu':128C,141C 'lack':37B 'layout':9A,57B,61B,104C,117C,130C 'manag':74C 'miss':84C 'modifi':54B,98C 'non':123C 'non-administr':122C 'open':29B,65C 'packag':21B 'platform':33B,69C 'player':79C 'prior':81C 'privileg':108C 'put':44B 'put/delete':90C 'rather':132C 'report':136C 'requir':106C 'self':23B 'self-host':22B 'separ':135C 'signag':20B,32B,68C 'softwar':80C 'sourc':30B,66C 'standard':126C 'system':75C 'user':3A,52B,96C 'version':145C 'vulner':139C 'web':35B,72C 'whose':34B 'window':77C 'xibo':1A,25B,26B,62C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Xibo CMS older than 4.4.3 with non-administrator users who have layout edit or delete rights. The sources describe this as the standard grant for non-administrators, so most multi-user installs fall in scope. The separately reported DataSet export issue is not covered by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52729","severity":null,"published_at":"2026-10-28T14:17:04+00:00","modified_at":"2026-10-28T14:17:04+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","fetched_at":"2026-10-28T14:33:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}