CVE-2026-52729— Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

Quick assessment

Affected

xibosignage xibo-cms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Xibo 是一个开源的数字标牌平台，包含基于 Web 的内容管理系统和 Windows 显示播放器软件。在 4.4.3 版本之前，接口缺少访问控制检查，导致已认证用户能够修改或删除任意布局（Layout）中的操作（Actions）。利用该漏洞需要拥有对所有已创建布局进行编辑（包括删除）的权限，而该权限默认授予非管理员用户。此问题涉及“布局操作”（Layout actions），与另行报告的“数据集导出”漏洞无关。该问题已在 4.4.3 版本中修复。

CVSS 7.1 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1068.002 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

Source: CVE Program / CVE List V5

Vulnerability Description

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns `Layout actions` rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
xibosignage	xibo-cms	< 4.4.3	-

II. Public POCs for CVE-2026-52729

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-52729

请登录查看更多情报信息。

Other References for CVE-2026-52729 (6)

https://github.com/xibosignage/xibo-cms/pull/3492 x_refsource_MISC
https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3 x_refsource_MISC
https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta x_refsource_MISC
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7j3h-48f7-w4fr x_refsource_CONFIRM
https://github.com/xibosignage/xibo-cms/commit/96d7b458781b8cd10e64788565fbdeffd15f08cf x_refsource_MISC
https://github.com/xibosignage/xibo-cms/commit/efd13abf868e2386f40929ed6e4f36fead310f20 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-52729

Same Patch Batch · xibosignage · 2026-10-28 · 5 CVEs total

CVE-2026-50541	6.5 MEDIUM	Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbi
CVE-2026-50539	6.5 MEDIUM	Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated
CVE-2026-50542	5.4 MEDIUM	Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary
CVE-2026-50543	4.3 MEDIUM	Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitra

IV. Related Vulnerabilities

Same product: xibo-cms

Same vendor: xibosignage

Same weakness: CWE-862