CVE-2026-100847

HIGHCVSS 7.5

Description

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.

Timeline

Published:September 27th, 2026 2:17 AM

Last modified:September 30th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-89

References & Reports

Advisories, patches, and third-party reports

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-jqwc-h3rq-frmw
https://www.vulncheck.com/advisories/azuracast-before-0.23.8-dql-injection-via-sortorder
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-jqwc-h3rq-frmw

Source: NIST NVD · Data may lag official sources by up to one minute