Executive brief
Xibo is an open-source digital signage platform used to manage and display content on networked screens. A flaw in the Module settings feature allows authorized users with module-viewing privileges to access and view sensitive super-admin configuration data they should not see, potentially exposing module configuration details. This vulnerability only affects users already granted module-viewing access, which is typically restricted to administrators.
Technical details
The vulnerability is a missing authorization check in the Module::settingsForm method, stemming from a PHP operator precedence issue. An attacker who is an authorized user with the Module View privilege (not granted to non-admins by default) can bypass authorization checks to view (but not modify) super-admin-restricted module settings and access the full module entity. The attack vector is network-based with low complexity, requiring low-level privileges (a Module View role) and no user interaction. The impact is limited to confidentiality disclosure of module configuration data. The fix is available in version 4.4.3.
Affected products
- Xibo Xibo CMS prior to 4.4.3
Timeline
- 2026-05-13: disclosed: Responsible disclosure initiated
- 2026-05-19: patched: Fix available in release version 4.4.3
- 2026-06-21: advisory: Public disclosure via GHSA-6h64-j36j-h2v2
- 2026-08-31: other: CVE-2026-52730 published