CVE-2026-31956

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of the vulnerability is possible on behalf of an authorized user who has any of the following privileges: Page which shows all Layouts that have been created for the purposes of Layout Management; page which shows all Campaigns that have been created for the purposes of Campaign Management; and page which shows all Reports that have been Saved. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate.

• CWE-639

• https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1Release Notes
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-q6rv-8hhj-3fr8Vendor Advisory

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31950LibreChat is a ChatGPT clone with additional features. In ve…5.3
• CVE-2026-31951LibreChat is a ChatGPT clone with additional features. In ve…5.7
• CVE-2026-31952Xibo is an open source digital signage platform with a web c…8.1
• CVE-2026-31953Xibo is an open source digital signage platform with a web c…5.4
• CVE-2026-31954Emlog is an open source website building system. In 2.6.6 an…7.3
• CVE-2026-31955Xibo is an open source digital signage platform with a web c…4.9
• CVE-2026-31957Himmelblau is an interoperability suite for Microsoft Azure …10
• CVE-2026-31958Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-31959Quill provides simple mac binary signing and notarization fr…5.3
• CVE-2026-3196An integer overflow vulnerability was found in the virtio-sn…5.5
• CVE-2026-31960Quill provides simple mac binary signing and notarization fr…5.3
• CVE-2026-31961Quill provides simple mac binary signing and notarization fr…5.5