CVE-2026-50541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50541", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-04T20:37:18.653Z", "datePublished": "2026-10-28T13:25:10.271Z", "dateUpdated": "2026-11-03T12:59:56.849Z"}, "containers": {"cna": {"title": "Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6xr-pmg9-qpmv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6xr-pmg9-qpmv"}, {"name": "https://github.com/xibosignage/xibo-cms/pull/3493", "tags": ["x_refsource_MISC"], "url": "https://github.com/xibosignage/xibo-cms/pull/3493"}, {"name": "https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556", "tags": ["x_refsource_MISC"], "url": "https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556"}, {"name": "https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b", "tags": ["x_refsource_MISC"], "url": "https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b"}, {"name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3"}, {"name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta", "tags": ["x_refsource_MISC"], "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta"}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"version": "< 4.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T13:25:10.271Z"}, "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3."}], "source": {"advisory": "GHSA-v6xr-pmg9-qpmv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T12:59:18.757590Z", "id": "CVE-2026-50541", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T12:59:56.849Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T12:59:18.757590Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T12:59:42.590Z"}}], "cna": {"title": "Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export", "source": {"advisory": "GHSA-v6xr-pmg9-qpmv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"status": "affected", "version": "< 4.4.3"}]}], "references": [{"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6xr-pmg9-qpmv", "name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6xr-pmg9-qpmv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xibosignage/xibo-cms/pull/3493", "name": "https://github.com/xibosignage/xibo-cms/pull/3493", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556", "name": "https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b", "name": "https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3", "name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta", "name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T13:25:10.271Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50541", "state": "PUBLISHED", "dateUpdated": "2026-11-03T12:59:56.849Z", "dateReserved": "2026-06-04T20:37:18.653Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T13:25:10.271Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xibo-cms", "vendor": "xibosignage", "versions": [{"status": "affected", "version": "< 4.4.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3."}, {"lang": "es", "value": "Xibo es una plataforma de se\u00f1alizaci\u00f3n digital de c\u00f3digo abierto con un sistema de gesti\u00f3n de contenido web y software de reproductor de pantalla para Windows. Versiones anteriores a la 4.4.3, la falta de comprobaciones de control de acceso en \u201cGET /dataset/export/csv/{id}\u201d permite a un usuario autenticado exportar datos de cualquier conjunto de datos, incluidos los conjuntos de datos creados por administradores, al iterar sobre los ID de conjuntos de datos secuenciales. La explotaci\u00f3n requiere acceso al privilegio que permite ediciones, incluida la eliminaci\u00f3n, de todos los \u201cDataSets\u201d creados independientemente de los \u201cLayouts\u201d. Este privilegio no se concede a los no administradores de forma predeterminada. Este problema se solucion\u00f3 en la versi\u00f3n 4.4.3."}], "id": "CVE-2026-50541", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50541", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T12:59:18.757590Z", "version": "2.0.3"}}]}, "published": "2026-10-28T14:17:03.980", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556"}, {"source": "security-advisories@github.com", "url": "https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b"}, {"source": "security-advisories@github.com", "url": "https://github.com/xibosignage/xibo-cms/pull/3493"}, {"source": "security-advisories@github.com", "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta"}, {"source": "security-advisories@github.com", "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6xr-pmg9-qpmv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.3)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "xibo-cms", "source": "cna", "vendor": "xibosignage"}, "product": "xibo", "vendor": "xibosignage"}], "created": "2026-10-28T14:45:13.999494+00:00", "updated": "2026-10-28T22:00:16.644314+00:00", "vendors": ["xibosignage", "xibosignage$PRODUCT$xibo"]}