CVE-2026-52730

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak the full module entity. Exploitation of the vulnerability is possible on behalf of an authorized user who has access to the Module View feature, which are not granted to non-admins as standard. Users should upgrade to version 4.4.3 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.

• CWE-862

• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-6h64-j36j-h2v2

Published

Aug 31, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52723ePA 3.x Integration implements the authorization workflow an…9.1
• CVE-2026-52724Kuma is a modern Envoy-based service mesh that can run on ev…5.8
• CVE-2026-52725Angular is a development platform for building mobile and de…6.1
• CVE-2026-52726Dulwich is a pure-Python implementation of the Git file form…7.5
• CVE-2026-52727lxc-ci contains continuous integration and image-build scrip…7.2
• CVE-2026-5273Use after free in CSS in Google Chrome prior to 146.0.7680.1…6.3
• CVE-2026-52731ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…6.5
• CVE-2026-52732ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…5.3
• CVE-2026-52733ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…6.5
• CVE-2026-52734ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…5.3
• CVE-2026-52735ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…9.3
• CVE-2026-52736ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…8.7