AzuraCast CVE-2026-121430

Requires a valid AzuraCast login of the lowest privilege tier - any authenticated account with zero station assignment suffices (PR:L); no admin or station grant is needed. The attacker also needs network reach to the API and a target station_id plus a media_id to address (enumerable/guessable). The specific affected feature is the station-scoped waveform endpoints GET/POST /api/station/{station_id}/waveform/{media_id} (GetWaveformAction / PostCacheWaveformAction), which - unlike sibling /quota, /art, and /files/* routes - carry no Permissions(StationPermissions) middleware. LIMITING FACTORS: exploitation requires authentication (not anonymous); impact is confined to per-media cached waveform JSON (disclosure and overwrite), not the media files, credentials, arbitrary filesystem paths, or availability; affects installations on the rolling main branch / before the fixed release. No user interaction and no non-default configuration are required - the gap is present in the default compiled route table.

This is a genuine but moderate-priority access-control flaw, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scoring 5.3 Medium is consistent with the mechanism: network-reachable, low complexity, no user interaction, but requiring PR:L - any authenticated account. Impact is deliberately bounded (VC:L/VI:L/VA:N): cross-station disclosure and tampering of cached waveform JSON only, not media files, credentials, or arbitrary paths. There is NO KEV listing and NO EPSS score in the provided data, so active-exploitation and statistical-likelihood signals are simply absent rather than negative. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a medium severity. A public PoC exists in the GHSA advisory but it dynamically proves the missing-middleware gap via route-table reflection - it is not verified as a full working HTTP exploit against a live multi-user instance. The authentication requirement (PR:L) and the narrow, non-destructive impact are the main factors keeping real-world risk below the raw network-vector reading. One data conflict to flag: the CVE description says 'before 0.24.0' (implying 0.24.0 fixes it), while the package evidence states 'fixed in: not yet patched' and the advisory confirms against rolling main as of 2026-09-04 with no version-gated history - verify the actual fixed version with the vendor.

An attacker registers or obtains any low-privilege AzuraCast account with no station assignment, then sends an authenticated POST to /api/station/{station_id}/waveform/{media_id} targeting a station they have no access to. Because the route carries no Permissions middleware, the attacker-supplied JSON body overwrites that station's cached waveform file, corrupting the Visual Cue Editor data its legitimate operators will next edit; the GET counterpart similarly leaks another station's cached waveform. A public PoC in the GHSA advisory demonstrates the missing-authorization mechanism via live route-table introspection, though it is not a verified end-to-end HTTP exploit.