Xibo CMS EUVD-2026-112086

Requires an authenticated CMS account AND the specific non-default privilege 'Allow edits including deletion to all created DataSets independently to Layouts,' which the vendor states is not granted to non-administrators as standard. With that privilege, the attacker reaches GET /dataset/export/csv/{id} over the network and iterates sequential dataset IDs to export datasets owned by others, including administrators. Limiting factors: the elevated privilege gate (near-admin, not available to ordinary users by default), the fact that impact is read-only disclosure of dataset contents (no integrity/availability effect), and that only deployments on version 4.4.2 or earlier are affected (fixed in 4.4.3).

This is a moderate, authorization-scoped information-disclosure issue rather than a top-priority emergency. The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network reachability with low complexity and no user interaction, but confidentiality-only impact (C:H, I:N, A:N) via missing object-level authorization (CWE-862). A key signal conflicts with the raw vector: although the vector encodes PR:L, the advisory states exploitation requires the privilege 'Allow edits including deletion to all created DataSets independently to Layouts,' which is explicitly NOT granted to non-administrators by default - so in practice the required privilege is near-administrative, which lowers real-world exploitability below what PR:L implies. No EPSS score, no CISA KEV listing, and no verified public exploit code were provided in the input; the only exploitation status we can assert is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' (not act_now/emergency). Net: a real but non-urgent fix - prioritize patching within the month and audit who holds the elevated DataSet privilege, but this is not a widely-automatable, unauthenticated mass-exploitation scenario.

An authenticated Xibo CMS user who has been granted the elevated 'edit/delete all DataSets independently of Layouts' privilege calls GET /dataset/export/csv/{id} while incrementing the numeric {id}, and because the endpoint performs no per-object access-control check (fixed by adding checkEditable), the server returns CSV exports of datasets the user was not meant to see, including administrator-created datasets. No public exploit code is identified in the sources, though the GHSA advisory and the fix PR diff publicly document the exact vulnerable endpoint and trigger.