CVE-2026-52729
Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns `Layout actions` rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.
| CWE | CWE-862 |
| Vendor | xibosignage |
| Product | xibo-cms |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for xibosignage xibo-cms
Be the first to know when new high vulnerabilities affecting xibosignage xibo-cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
xibosignage / xibo-cms
< 4.4.3
References
github.com: https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7j3h-48f7-w4fr github.com: https://github.com/xibosignage/xibo-cms/pull/3492 github.com: https://github.com/xibosignage/xibo-cms/commit/96d7b458781b8cd10e64788565fbdeffd15f08cf github.com: https://github.com/xibosignage/xibo-cms/commit/efd13abf868e2386f40929ed6e4f36fead310f20 github.com: https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3 github.com: https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta