EUVD-2026-87835
GHSA-j79h-v95g-w786
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify public AzuraCast station
-
DeliveryEnumerate valid media identifiers
-
ExploitRequest On-Demand download endpoint directly
-
ExecutionBypass playlist-level access check
-
ImpactDownload restricted audio content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against any AzuraCast instance before 0.23.8 that exposes the public On-Demand download endpoint and relies on playlist-level access controls to keep certain media private. The concrete prerequisite is possession of valid media identifiers for the target station - the attacker requests those IDs directly at the download endpoint, and the server fails to check whether the media belongs to an On-Demand-enabled playlist. Limiting factors: exploitation only exposes media the operator intended to restrict (stations without restricted On-Demand content have nothing to leak), and the attacker must obtain/enumerate valid media IDs (the vendor's AC:H/AT:P reflects this, though IDs may be enumerable). No authentication and no user interaction are required (PR:N/UI:N). |
| Impact | This is a genuine but moderate-severity access-control flaw, not a critical one despite the 8.2 vendor score. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) correctly captures an unauthenticated, network-reachable confidentiality-only issue, but the VC:H rating is generous: the exposed asset is restricted/private audio media, not credentials, PII, or system secrets, so real-world impact is bounded to content disclosure. The AC:H/AT:P complexity flags reflect that an attacker needs valid media identifiers to reach protected files - but such identifiers are frequently sequential/enumerable, which could make exploitation easier than AC:H implies (verify enumerability against the actual endpoint). No EPSS score, no CISA KEV listing, and no public exploit code are provided; per the precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. Net: prioritize as a data-exposure fix for AzuraCast operators who rely on playlist-level On-Demand restrictions, but this is not an urgent RCE/takeover-class issue. |
| Exploit ScenarioDerived | An unauthenticated attacker who knows or can enumerate valid media IDs on a public AzuraCast station directly requests the On-Demand download endpoint, retrieving audio files that the operator deliberately excluded from On-Demand-enabled playlists. No credentials or user interaction are required, though the attacker must possess valid media identifiers. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Unauthenticated media exposure in AzuraCast before 0.23.8 allows remote attackers to download audio files that station operators intended to keep private, because the public On-Demand download endpoint does not verify playlist-level access controls before serving a requested media item (CWE-862 Missing Authorization). Any deployment that exposes the On-Demand endpoint and relies on playlist membership to restrict content is affected, and no authentication or user interaction is required once an attacker has a valid media identifier for the target station. The impact is confidentiality-only with no write or availability effect; exploitation is not confirmed as actively exploited and no public exploit code identified at time of analysis, so despite the vendor's 8.2 score this is a genuine but moderate-severity access-control flaw.
RemediationAI
Vendor-released patch: 0.23.8 - upgrade AzuraCast to 0.23.8 or later and then verify as an unauthenticated user that media excluded from On-Demand-enabled playlists can no longer be retrieved from the download endpoint. If upgrading immediately is not possible, the most direct compensating control is to disable the public On-Demand download endpoint entirely or place it behind authentication, accepting that legitimate listeners lose on-demand download functionality; alternatively restrict network access to the endpoint (IP allow-listing or reverse-proxy auth) so only trusted users can reach it. Because the bug hinges on valid media identifiers, consider obfuscating or rotating enumerable media IDs, but weigh that against breaking existing shareable download links. Additionally, rate-limit and monitor requests to the download route via reverse proxy or WAF rules to catch sequential media-ID enumeration, and review web logs for direct media-ID requests from unauthenticated clients; these detective controls reduce exposure but do not fix the underlying missing authorization check, so the upgrade remains the definitive remediation. Details are in the vendor advisory at https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q9cc-mp52-vrp9.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AzuraCast is a self-hosted web radio and streaming management platform (fronting Icecast/Liquidsoap) whose On-Demand feature lets listeners request and download individual media files from a station. Playlist-level settings are meant to gate which items can be served on demand, but the public download route returns the requested media without checking that it belongs to an On-Demand-enabled playlist, making this a missing-authorization defect (CWE-862) rather than a memory-safety or injection bug. The affected product space is captured by the wildcard CPE cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:* with the fix boundary at version 0.23.8, and the vendor's AC:H/AT:P metrics reflect that exploitation depends on the station's specific configuration and on obtaining valid media identifiers - though such identifiers can plausibly be enumerated from public station pages or APIs, which lowers the practical barrier. The independent assessment (CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the unauthenticated attack path and the confidentiality-only impact.
Know when Azuracast gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network request (AV:N/PR:N/UI:N); AC:H because valid media identifiers must be known/enumerated; confidentiality-only disclosure of restricted media, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.
Technical POC Analysis
Note on sourcing: the supplied evidence is the GitHub Security Advisory GHSA-q9cc-mp52-vrp9 only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
AzuraCast deployments prior to 0.23.8 can expose private station audio through the public On-Demand download endpoint, allowing remote actors with a valid media identifier to retrieve content that playlist-level controls were meant to protect. This is a confidentiality-only access-control flaw with no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should prioritize inventorying affected stations, limiting endpoint exposure, and monitoring for unauthorized media downloads. The reputational and contractual risk is greatest for stations that host sensitive, embargoed, or subscriber-only audio.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or restricting the public On-Demand download endpoint, requiring authentication at the reverse proxy or WAF for media downloads, validating playlist-level access controls, and monitoring logs for unauthorized downloads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Related Vulnerabilities in AzuraCast SSRF, Injection, and Access Control Flaws
View all 11Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. Rate
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. Rated medium severity (CVSS
Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization grou
Unauthenticated HTTP requests to AzuraCast 0.23.1's internal sftpgo integration endpoints (/api/internal/sftp-auth and /
Exploit-DB