# CVE-2026-50541: Xibo CMS missing access control in dataset export

Source: https://junglewise.ai/threats/cve-2026-50541-xibo-is-an-open-source-digital-signage-platform-with-a-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-50541 · Severity: medium · CVSS 6.5 · Published 2026-10-28

Xibo is a digital signage platform with a web-based content management system. An authenticated user with dataset editing privileges can export datasets belonging to other users, including administrators, by exploiting a missing access control check. An attacker could gain unauthorized access to sensitive business data stored in datasets across the platform.

Technologies: [Xibo CMS](https://junglewise.ai/threats/technologies/xibo-cms). Vendors: [Xibo](https://junglewise.ai/threats/vendors/xibo).

## Quick answers

**Is CVE-2026-50541 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50541 being exploited in the wild.

**How severe is CVE-2026-50541?** Medium severity, with a CVSS score of 6.5, published 28 October 2026.

**Which products and versions are affected?** Xibo CMS prior to 4.4.3.

**Is there a fix for CVE-2026-50541?** Yes: fixed in 4.4.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50541 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-50541?** Check whether you run Xibo CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.4.3

## Technical details

Missing access control on the `GET /dataset/export/csv/{id}` endpoint allows authenticated users with DataSet edit permissions to export any dataset by iterating sequential IDs, bypassing ownership checks. The fix adds a `checkEditable()` validation before allowing CSV export. This requires authentication and specific dataset editing privileges, limiting the scope to users already granted such permissions.

## Affected products

- Xibo Xibo CMS prior to 4.4.3

## Timeline

- 2026-10-28: disclosed
- 2026-10-28: patched

## References

- [https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556](https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556)
- [https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b](https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b)

## Related threats

- [Xibo CMS authorization bypass in display group criteria update](https://junglewise.ai/threats/cve-2026-50543-xibo-is-an-open-source-digital-signage-platform-with-a-web)
- [Xibo CMS access control bypass in layout status endpoint](https://junglewise.ai/threats/cve-2026-50542-xibo-is-an-open-source-digital-signage-platform-with-a-web)
- [Xibo CMS missing object-level authorization in notification export](https://junglewise.ai/threats/cve-2026-50539-xibo-is-an-open-source-digital-signage-platform-with-a-web)
- [Xibo missing authorization in Module::settingsForm](https://junglewise.ai/threats/cve-2026-52730-xibo-missing-authorization-in-module-settingsform)