CVE-2026-50542 Details
Description
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /layout/status/{id}` allow an authenticated user with any privileges to view the `status and metadata` of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
An access control vulnerability has been identified in Xibo CMS, an open-source digital signage platform. Prior to version 4.4.3, the application lacked proper access control checks on the 'GET /layout/status/{id}' endpoint. This oversight allowed authenticated users, regardless of their privileges, to access the status and metadata of any layout. As a result, users could view information about layouts for which they did not have explicit viewing rights. The vulnerability has been patched in version 4.4.3.
Users are advised to upgrade to Xibo CMS version 4.4.3 or later, which addresses this vulnerability. For those unable to upgrade, it is recommended to revoke CMS access from untrusted users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xibosignage/xibo-cms/commit/610f0ecbfdf7667d67c0dbe4aebc85245040d952 | [email protected] | Source CodeVendor |
| https://github.com/xibosignage/xibo-cms/commit/97e878f13615db2a448fdcff22895a19005f5d3a | [email protected] | Source CodeVendor |
| https://github.com/xibosignage/xibo-cms/pull/3481 | [email protected] | Source CodeVendor |
| https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3 | [email protected] | Release NotesVendor |
| https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta | [email protected] | Release NotesVendor |
| https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-wj8r-32gf-6f5f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Xibo | <= 4.4.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Translated | [email protected] |
| Oct 28, 2026 | New CVE Received | [email protected] |
| Oct 28, 2026 | CVE Modified | CISA-ADP |