CVE-2026-100855

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

PT-2026-99475

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.6 Description An issue exists where a missing permission check in the 'GET /api/station/station id/file/id/play' endpoint allows authenticated users to download media files from any station. This can be exploit...