CVE-2026-31956 Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization

Medium 4.3 Published 24 Apr 2026 Updated 24 Apr 2026

Authenticated users can access other users' campaigns and reports by manipulating URLs due to missing controller-level authorization checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-31956?

CVE-2026-31956 is a medium-severity missing authorization vulnerability in xibosignage xibo-cms, published on 24 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of the vulnerability is possible on behalf of an authorized user who has any of the following privileges: Page which shows all Layouts that have been created for the purposes of Layout Management; page which shows all Campaigns that have been created for the purposes of Campaign Management; and page which shows all Reports that have been Saved. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate.

Weakness: CWE-639

Which versions are affected by CVE-2026-31956?

It affects 1 product.

Products include Xibosignage Xibo.

How do I fix CVE-2026-31956?

No fix has been published for CVE-2026-31956 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-31956 being exploited?

There is no known exploitation of CVE-2026-31956 in the wild and no public exploit code.

Sources

Also known as GHSA-q6rv-8hhj-3fr8.