# CVE-2026-52730: Xibo missing authorization in Module::settingsForm

Source: https://junglewise.ai/threats/cve-2026-52730-xibo-missing-authorization-in-module-settingsform  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-52730 · Severity: medium · CVSS 4.3 · Published 2026-08-31

Xibo is an open-source digital signage platform used to manage and display content on networked screens. A flaw in the Module settings feature allows authorized users with module-viewing privileges to access and view sensitive super-admin configuration data they should not see, potentially exposing module configuration details. This vulnerability only affects users already granted module-viewing access, which is typically restricted to administrators.

Technologies: [Xibo CMS](https://junglewise.ai/threats/technologies/xibo-cms). Vendors: [Xibo](https://junglewise.ai/threats/vendors/xibo).

## Quick answers

**Is CVE-2026-52730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52730 being exploited in the wild.

**How severe is CVE-2026-52730?** Medium severity, with a CVSS score of 4.3, published 31 August 2026.

**Which products and versions are affected?** Xibo CMS prior to 4.4.3.

**Is there a fix for CVE-2026-52730?** A patch was published on 2026-05-19: Fix available in release version 4.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52730 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-52730?** Check whether you run Xibo CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check in the Module::settingsForm method, stemming from a PHP operator precedence issue. An attacker who is an authorized user with the Module View privilege (not granted to non-admins by default) can bypass authorization checks to view (but not modify) super-admin-restricted module settings and access the full module entity. The attack vector is network-based with low complexity, requiring low-level privileges (a Module View role) and no user interaction. The impact is limited to confidentiality disclosure of module configuration data. The fix is available in version 4.4.3.

## Affected products

- Xibo Xibo CMS prior to 4.4.3

## Timeline

- 2026-05-13: disclosed: Responsible disclosure initiated
- 2026-05-19: patched: Fix available in release version 4.4.3
- 2026-06-21: advisory: Public disclosure via GHSA-6h64-j36j-h2v2
- 2026-08-31: other: CVE-2026-52730 published

## References

- [https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-6h64-j36j-h2v2](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-6h64-j36j-h2v2)

## Related threats

- [Xibo CMS authorization bypass in display group criteria update](https://junglewise.ai/threats/cve-2026-50543-xibo-is-an-open-source-digital-signage-platform-with-a-web)
- [Xibo CMS access control bypass in layout status endpoint](https://junglewise.ai/threats/cve-2026-50542-xibo-is-an-open-source-digital-signage-platform-with-a-web)
- [Xibo CMS missing object-level authorization in notification export](https://junglewise.ai/threats/cve-2026-50539-xibo-is-an-open-source-digital-signage-platform-with-a-web)
- [Xibo CMS missing access control in dataset export](https://junglewise.ai/threats/cve-2026-50541-xibo-is-an-open-source-digital-signage-platform-with-a-web)