Xibo CMS EUVD-2026-112139

Exploitation requires an authenticated Xibo CMS account that holds access to the Notification Centre to view past notifications - a privilege the vendor states is granted to non-administrators as standard, so the bar is low in typical deployments. Given that access, the attacker simply iterates over sequential notification IDs against /notification/export/{id}; no user interaction, no special or non-default configuration, and no administrative rights are needed. The limiting factor is solely the need for a valid account with the standard Notification Centre privilege: a fully unauthenticated attacker cannot exploit this, so risk scales with the number and trust level of CMS user accounts. Impact is bounded to downloading notification attachments and does not extend to modifying data or affecting availability.

This is a genuine but moderate-priority issue, not a top-of-queue emergency. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable and low-complexity, but requiring an authenticated account (PR:L), and the impact is confidentiality-only (C:H, I:N, A:N): the flaw leaks notification attachments but does not let an attacker modify data or disrupt service. The vuln.today Decision label is 'this_month', consistent with a real-but-not-urgent fix window. No EPSS probability was supplied and the CVE is not listed in CISA KEV, so exploitation is not confirmed active - no public exploit identified at time of analysis (the only references are the vendor advisory, fix PR, commits and release notes, i.e. patch artifacts, not exploit code). The signals are internally consistent: medium severity, authenticated-only, confidentiality-only, and a non-emergency decision label all point the same way. The main caveat is that the true sensitivity of the exposed data depends entirely on what administrators attach to notifications, which the sources do not characterize; C:H assumes those attachments can be sensitive. Treat as a standard patch-this-cycle item, with elevated attention where the Xibo CMS has many low-trust user accounts.

A low-privileged but authenticated Xibo CMS user who has the standard Notification Centre privilege enumerates sequential notification IDs and issues requests to /notification/export/{id} for IDs they do not own, downloading attachments from notifications created by administrators. No public exploit was identified, but the technique is simply iterating integer IDs against an existing endpoint, so reproduction is straightforward for any authenticated user. The attack is network-reachable (AV:N) and low-complexity (AC:L) but gated by the need for a valid account (PR:L).