CVE-2026-50539 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...