Xibo CMS CVE-2026-50542

Requires a valid authenticated Xibo CMS account of ANY privilege level (PR:L); the attacker does not need view rights on the targeted layout because the vulnerable GET /layout/status/{id} route lacked both the per-object checkViewable ACL and the layout.view/template.view FeatureAuth middleware (both added in 4.4.3). The primary limiting factor is that authentication is mandatory - this is not exploitable by unauthenticated internet attackers - so realistic risk is confined to environments with untrusted or over-provisioned CMS user accounts. Affected: xibo-cms <= 4.4.2; fixed in 4.4.3.

This is a moderate, authorization-only information-disclosure flaw (CWE-862, IDOR / broken object-level authorization), not a high-urgency issue. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4) indicates a network-reachable, low-complexity attack that requires an authenticated low-privilege account (PR:L). The exploitation status is 'no public exploit identified at time of analysis' - no KEV listing and no PoC reference appear in the input, and no EPSS score was provided, so widespread opportunistic exploitation cannot be inferred. The vuln.today decision label is 'this_month', which aligns with a patch-on-normal-cadence priority rather than act_now/emergency. One signal conflict: the input CVSS vector asserts I:L (integrity impact), but every authoritative source - the GHSA advisory and the description - states the flaw only allows an attacker to VIEW the status and metadata of layouts, i.e. read-only disclosure; the I:L component is not supported by the evidence and the true impact is confidentiality-only (C:L). Net: a real but low-to-medium priority issue gated behind authentication, best handled by scheduled patching.

An attacker who holds any authenticated Xibo CMS account (even the lowest-privilege user) enumerates layout IDs and issues GET /layout/status/{id} requests for layouts they have no view rights to, receiving the status and metadata of those layouts. Because the missing check was object-level authorization, the server returns data for layouts belonging to other users or groups. No public proof-of-concept exploit code is identified in the available sources.