AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

Summary The GET /api/station/stationid/file/id/play endpoint, handled by PlayAction, is missing the Middleware\Permissions check that protects all sibling routes in the same /file/id route group. Any authenticated user can download media files from any station, regardless of whether they have...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the PlayAction process. An attacker can access and download unauthorized media files by sending authenticated requests to the /api/station/stationid/file/id/play endpoint without proper station-level permission...