Xibo CMS EUVD-2026-112085

Requires an authenticated Xibo CMS account holding the 'Allow edits including deletion to all created Layouts' privilege, which the vendor states is granted to non-administrators as standard - so most ordinary user accounts qualify. The attacker then issues PUT or DELETE requests to /action/{id} for Layout actions they do not own. Limiting factors: a valid CMS login is mandatory (PR:L, not unauthenticated), the impact is confined to Layout actions (distinct from the separately reported DataSet export issue in CVE-2026-50541), and instances on versions 4.4.2 and earlier are affected while 4.4.3 is fixed. No special configuration beyond the default privilege set is needed.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and the CWE-862 missing-authorization root cause are consistent with the description and the fix diff, which adds checkEditable($layout) guards to the add/edit/delete handlers in Action.php - confirming a real IDOR/BOLA on PUT/DELETE /action/{id}. The vendor's own SSVC-style priority label is 'this_week' rather than act_now or emergency. No EPSS score and no KEV listing were provided, and there is no public exploit reference, so exploitation status is 'no public exploit identified at time of analysis'; absence of EPSS/KEV data is a gap, not evidence of low risk. The key limiting factor is that exploitation needs an authenticated account holding the 'allow edits including deletion to all created Layouts' privilege (PR:L) - impactful because that privilege is granted to non-administrators by default, but still gated behind having a valid CMS account. Impact is integrity-dominant (tampering with or deleting Layout actions) with low availability impact and no confidentiality loss, matching the C:N/I:H/A:L vector. Net: a credible insider/low-privilege-abuse data-integrity risk worth patching promptly, but not a widely-weaponized internet-facing threat on current evidence.

A low-privilege but authenticated Xibo CMS user - the kind of account routinely issued to content editors - sends a crafted PUT or DELETE request to /action/{id} referencing a Layout action they do not own. Because the pre-4.4.3 controller skips the editable-permission check, the request succeeds and the attacker tampers with or deletes actions on any Layout, including those of other users. No public exploit code is referenced, but the flaw is trivial to trigger with a standard authenticated session.