CVE-2026-50539

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539

The Xibo digital signage platform (prior to version 4.4.3 ) is vulnerable to missing object-level authorization on the /notification/export/{id} endpoint. This flaw allows an authenticated user to download attachments from any notification, including those created by administrators, by iterating ...

EUVD-2026-112139

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

PT-2026-128267

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-31953 Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login

Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting XSS vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript...