CVE-2026-50541 Details

A broken object-level authorization vulnerability has been identified in Xibo CMS versions prior to 4.4.3. This issue allows authenticated users with specific privileges to export data from any dataset, including those created by administrators. The vulnerability arises from missing access control checks on the 'GET /dataset/export/csv/{id}' endpoint, enabling exploitation by iterating over sequential dataset IDs. To exploit this vulnerability, an authenticated user must have the privilege to edit, including delete, all created datasets, regardless of layouts, a right not typically granted to non-administrators.

Users should upgrade to Xibo CMS version 4.4.3 or later, which addresses this vulnerability. For those unable to upgrade, it is advised to revoke dataset editing privileges from untrusted users.