CVE-2026-100855

MEDIUMCVSS 6.5

Description

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations they lack permissions for.

Timeline

Published:September 27th, 2026 2:17 AM

Last modified:September 30th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qff7-q5fm-8p76
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-missing-permission-check-via-play

Source: NIST NVD · Data may lag official sources by up to one minute