Xibo CMS EUVD-2026-112141

Requires (1) an authenticated account on the Xibo CMS, since the vulnerable POST /displaygroup/criteria/{displayGroupId} endpoint is reachable only after login (PR:L), and (2) the optional 'Schedule Criteria' feature to be actively in use on the CMS, as stated by the vendor advisory - without it there are no criteria updates to abuse. The limiting factors are therefore the need for valid CMS credentials and this non-default scheduling configuration; impact is confined to integrity of display scheduling/playback (no data disclosure, code execution, or outage). The fix enforces checkEditable on the target display group and adds FeatureAuth requiring displaygroup.modify/displays.modify permissions.

This is a genuine but low-urgency issue rather than a top-priority emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated CMS user (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. The vendor's own GHSA and the patch diff confirm the root cause (CWE-862 missing authorization): the POST /displaygroup/criteria/{displayGroupId} handler never called checkEditable on the target display group, so any authenticated user could push scheduling criteria to displays they do not own. No EPSS score and no KEV listing were supplied, and there is no public exploit reference in the input - only the advisory, PR, commit, and release links - so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is this_month, consistent with the modest impact: an attacker can skew scheduled playback (e.g. trigger rainy-weather content on a clear day) but cannot read data, run code, or take down the service. These signals align rather than conflict; the only notable caveat is that exploitation is gated on the optional 'Schedule Criteria' feature actually being in use, which narrows the real-world exposed population below what the network vector alone suggests.

An authenticated low-privilege user of a Xibo CMS where Schedule Criteria is in use sends a crafted POST to /displaygroup/criteria/{displayGroupId} targeting a display group they have no rights over. Because the endpoint omitted the authorization check, the criteria update is relayed to the player via XMR and alters what content the display shows, overriding the intended schedule. No public exploit code is referenced in the available sources; the trigger is a simple authenticated HTTP request with low attack complexity.