AzuraCast EUVD-2026-87820

Requires (1) an authenticated AzuraCast account - any valid session or API key, even one scoped to a single station (PR:L); and (2) a multi-tenant deployment where more than one station exists and cross-station isolation matters, since the attacker exfiltrates media from stations they lack permissions on. Exploitation is limited to AzuraCast versions <= 0.23.5 (fixed in 0.23.6). No user interaction is needed and IDs are trivially enumerable because the /file/{id}/play endpoint accepts sequential auto-increment integers. On single-operator instances the flaw has no practical impact since the attacker would already control all stations.

This is a genuine but moderate-severity broken-access-control flaw (CWE-862), not an inflated high-CVSS issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent and I largely agree: network-reachable, low attack complexity, requires an authenticated low-privilege account (PR:L), and confidentiality-only impact (VC:H, no integrity or availability effect). The GHSA advisory contains a working PoC (bash exploitation steps), so publicly available exploit code exists - this raises practical risk beyond a paper vulnerability. However, no EPSS score, no CISA KEV listing, and no SSVC decision data were provided, so there is no evidence of active exploitation; the PoC signal and the active-exploitation signal must not be conflated. The realistic risk is highest in multi-tenant AzuraCast deployments where distinct operators share one instance and expect per-station isolation; in single-tenant/single-operator installs the impact is negligible because the attacker would already own all stations. Net: real, verifiable, worth patching for multi-tenant hosts, but low-to-medium priority given confidentiality-only scope, low-privilege authentication requirement, and a niche product footprint.

In a multi-tenant AzuraCast instance, an attacker holds a valid account with permissions on Station A only. Because GET /api/station/{station_id}/file/{id}/play lacks the station-level permission middleware, they script sequential integer file IDs against Station B and download its entire media library despite having no rights on it. A working PoC demonstrating this is published in the GHSA advisory.