CVE-2026-50541— Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

Quick assessment

Affected

xibosignage xibo-cms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Xibo 是一个开源的数字标牌平台，包含基于 Web 的内容管理系统和 Windows 显示端播放器软件。在 4.4.3 版本之前，接口缺少访问控制检查，导致已认证用户可通过遍历“连续的数据集 ID"导出任意数据集的数据，包括由管理员创建的数据集。利用此漏洞需要拥有独立于布局（Layouts）之外、对所有已创建“数据集（DataSets）”进行编辑（含删除）的权限。该权限在默认配置下不会授予非管理员用户。此问题已在 4.4.3 版本中修复。

CVSS 6.5 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1069 · Permission Groups Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

Source: CVE Program / CVE List V5

Vulnerability Description

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
xibosignage	xibo-cms	< 4.4.3	-

II. Public POCs for CVE-2026-50541

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-50541

请登录查看更多情报信息。

Other References for CVE-2026-50541 (6)

https://github.com/xibosignage/xibo-cms/pull/3493 x_refsource_MISC
https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3 x_refsource_MISC
https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta x_refsource_MISC
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6xr-pmg9-qpmv x_refsource_CONFIRM
https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556 x_refsource_MISC
https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-50541

Same Patch Batch · xibosignage · 2026-10-28 · 5 CVEs total

CVE-2026-52729	7.1 HIGH	Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary
CVE-2026-50539	6.5 MEDIUM	Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated
CVE-2026-50542	5.4 MEDIUM	Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary
CVE-2026-50543	4.3 MEDIUM	Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitra

IV. Related Vulnerabilities

Same product: xibo-cms

Same vendor: xibosignage

Same weakness: CWE-862