Is CVE-2026-50543 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50543 being exploited in the wild.

How severe is CVE-2026-50543?

Medium severity, with a CVSS score of 4.3, published 28 October 2026.

Is there a fix for CVE-2026-50543?

Yes: fixed in 4.4.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50543 attacked?

It is attacked over the network.

Am I affected by CVE-2026-50543?

Check whether you run Xibo CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50543: Xibo CMS authorization bypass in display group criteria update

CVE-2026-50543 · Severity: medium · CVSS 4.3 · Published 2026-10-28

Xibo is a digital signage platform that manages content displayed on screens across locations. An authenticated user could send unauthorized criteria updates to any display group, potentially causing incorrect content to play at wrong times—such as weather-based content appearing when conditions don't match. The vulnerability requires the Schedule Criteria feature to be enabled and is fixed in version 4.4.3.

Technologies: Xibo CMS. Vendors: Xibo.

Quick answers

Is CVE-2026-50543 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50543 being exploited in the wild.
How severe is CVE-2026-50543?: Medium severity, with a CVSS score of 4.3, published 28 October 2026.
Which products and versions are affected?: Xibo CMS before 4.4.3.
Is there a fix for CVE-2026-50543?: Yes: fixed in 4.4.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50543 attacked?: It is attacked over the network.
Am I affected by CVE-2026-50543?: Check whether you run Xibo CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.4.3

Technical details

Missing authorization checks on the POST /displaygroup/criteria/{displayGroupId} endpoint allowed authenticated users to update criteria for any display group without verifying ownership or edit permissions. The fix adds a checkEditable() authorization check before processing criteria updates. Attack requires authentication and the Schedule Criteria feature to be in use.

Affected products

Xibo CMS before 4.4.3

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.