CVE-2026-52729 Details
Description
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns `Layout actions` rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.
A broken object-level authorization vulnerability has been identified in Xibo CMS, an open-source digital signage platform. This issue, present in versions through 4.4.2, allows authenticated users to modify or delete actions on any Layout via the PUT or DELETE methods on the /action/{id} endpoint. The vulnerability arises from missing access control checks, which exploitation requires the privilege to edit all created Layouts—a standard allowance for non-administrators. This vulnerability specifically impacts Layout actions, distinct from a separately reported DataSet export issue.
Users should upgrade to Xibo CMS version 4.4.3 or later, which addresses this vulnerability. For those unable to upgrade, it is advised to revoke editing privileges from untrusted users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xibosignage/xibo-cms/commit/96d7b458781b8cd10e64788565fbdeffd15f08cf | [email protected] | Source CodeVendor |
| https://github.com/xibosignage/xibo-cms/commit/efd13abf868e2386f40929ed6e4f36fead310f20 | [email protected] | Source CodeVendor |
| https://github.com/xibosignage/xibo-cms/pull/3492 | [email protected] | Source CodeVendor |
| https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3 | [email protected] | Release NotesVendor |
| https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta | [email protected] | Release NotesVendor |
| https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7j3h-48f7-w4fr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Xibo | <= 4.4.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Translated | [email protected] |
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |