AzuraCast CVE-2026-121428

Requires an authenticated AzuraCast account holding station-scoped permission to edit the station profile (confirmed by CVSS PR:L and the advisory, which reproduced the issue with a non-super-admin, station-only account). The specific trigger is setting the station timezone field to a string containing newlines plus a Supervisor [program:z] block via the profile edit API; buildEnvironment() escapes % but not newlines, so the value is injected into the generated supervisord.conf. Exploitation completes only when the station configuration is regenerated - the restart action may require an additional station permission, but a stored malicious value is still processed if regeneration is later triggered for any other reason. Affected through version 0.23.8; no non-default configuration is otherwise needed, and no fixed release is available.

This is a credible this-week priority rather than inflated CVSS. The vendor-confirmed CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity code-injection flaw yielding full confidentiality/integrity/availability loss, and the GHSA advisory confirms the injected command runs as root inside the AzuraCast runtime - a real privilege gain for a merely station-scoped account. PR:L correctly reflects that this is NOT unauthenticated: the attacker must already be an authenticated station manager able to edit the station profile, which materially narrows the threat population to users who already hold some access (insider, compromised manager credential, or multi-tenant station operator). A public PoC reference exists in the GHSA advisory (full reproduction on 0.23.8); it is not flagged in the input as verified working exploit code, and there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation - the risk is latent-but-serious, not confirmed in-the-wild. A key limiting signal to weigh: the input states the product is 'not yet patched,' so defenders cannot remediate by upgrading and must rely on access control to the station-profile permission. The authenticated precondition and absence of KEV/EPSS argue against emergency status, consistent with the vuln.today 'this_week' decision label.

An authenticated station manager (or an attacker who has phished/obtained such a station-scoped credential) submits a timezone value containing newlines to the PUT /api/station/{id}/profile/edit API, embedding a crafted [program:z] Supervisor section. When the station configuration is regenerated - e.g. via POST /api/station/{id}/restart or any later automatic regeneration - Supervisor parses the injected program and executes the attacker's OS command as root. A detailed public PoC reproducing this on AzuraCast 0.23.8 (creating /tmp/AZ_ID showing uid=0(root)) is included in the vendor GHSA advisory.