AzuraCast CVE-2026-100847

Exploitation requires reaching the AzuraCast list/search API endpoint backed by AbstractSearchableListAction.php and supplying a malicious value in the sortOrder request parameter; the flaw is DQL (Doctrine) injection, so any AzuraCast instance before 0.23.8 with this API reachable over the network is exposed. Per the vendor CVSS 4.0 vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special non-default configuration are required - the primary limiting factor is network reachability of the AzuraCast web/API interface (many deployments are internet-facing radio panels, but some are behind reverse proxies or restricted networks). Impact is limited to information disclosure (credentials and station settings); no data modification or denial of service is indicated.

This is a genuine, actionable priority within the population of AzuraCast deployments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a fully remote, unauthenticated, low-complexity attack with no user interaction, and the vendor scores it 8.7 (High). Impact is confidentiality-only (VC:H, VI:N, VA:N) - consistent with a read-oriented DQL injection that extracts data rather than modifying it or crashing the service. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation is not confirmed to be active or automated in the wild; the elevated score is driven by ease-of-access rather than observed exploitation. There are no conflicting signals: the description (network API parameter, credential extraction) aligns cleanly with the network/unauth CVSS vector. The key gap is the absence of exploitation-probability telemetry (EPSS/SSVC/KEV all missing), so real-world exploitation likelihood must be inferred from the low attack barrier alone. Because the endpoint reportedly exposes user credentials, defenders should treat any exploitation as leading to credential compromise and potential follow-on account takeover.

A remote attacker sends an API request to an AzuraCast list/search endpoint with a crafted sortOrder value that injects arbitrary Doctrine Query Language (DQL) expressions. The malicious sortOrder alters the query so that sensitive fields - user credentials and station settings - are returned in the response, letting the attacker exfiltrate them without authentication. No public exploit code was identified in the provided data, but the low complexity and unauthenticated network vector make manual exploitation straightforward.