AzuraCast CVE-2026-100854

Requires an authenticated account holding at least the basic 'View station' permission on the target station (PR:L) - not fully unauthenticated. Exploitation works against default deployments because the /api/internal/{station_id}/liquidsoap/{action} route ships without the RequireInternalConnection middleware, and nginx only enforces the IS_INTERNAL FastCGI parameter on internal port 6010, leaving the endpoint reachable from public ports 80/443. The attacker supplies any arbitrary value for the X-Liquidsoap-Api-Key header; the value is never validated when the ACL check passes. Impact is capped at metadata spoofing, broadcast-tracking disruption, and filesystem path disclosure. Most relevant to multi-tenant AzuraCast installations where untrusted users hold station accounts; single-operator instances face little realistic exposure.

This is a genuine but moderate-severity access-control flaw (CWE-862), not an inflated high-CVSS issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3, consistent with a low-privilege authenticated user achieving low-magnitude confidentiality, integrity, and availability impacts. No EPSS score, no CISA KEV listing, and no separately packaged POC are present in the input - so exploitation status is 'no public exploit identified,' though the GHSA advisory documents the exact vulnerable code (route table, header-presence logic) in enough detail to be effectively reproducible. The key signals align rather than conflict: low privilege requirement plus network vector make it easy to trigger for anyone with a station account, but the ceiling is low (metadata spoofing, broadcast disruption, filesystem path leakage - not RCE or full data theft). The real limiting factor is that the attacker must already hold the basic 'View station' permission on a target station, so the population of attackers is authenticated tenants of a multi-user AzuraCast install. Net: a real priority for multi-tenant AzuraCast operators, low priority for single-operator instances.

A user holding only the basic 'View station' permission sends a GET/POST to the public-facing /api/internal/{station_id}/liquidsoap/{action} endpoint with any arbitrary X-Liquidsoap-Api-Key header value. Because the route lacks the RequireInternalConnection middleware and $asAutoDj is set from header presence rather than a validated key, the request is treated as a privileged AutoDJ call, letting the attacker inject fake now-playing metadata seen by all listeners, disrupt live broadcast tracking, and read back absolute filesystem paths. No standalone POC is published, but the advisory details the exact endpoint and header behavior.