Description

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak the full module entity. Exploitation of the vulnerability is possible on behalf of an authorized user who has access to the Module View feature, which are not granted to non-admins as standard. Users should upgrade to version 4.4.3 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T20:17:05.427Z",
  "pubdate": "2026-08-31T20:17:05.427Z",
  "executiveSummary": "Xibo CMS is affected by an improper authorization vulnerability within the Module::settingsForm function, originating from a failure to adequately enforce security constraints when accessing module configuration parameters.\nThe vulnerability allows an authenticated user with the 'Module View' capability to bypass administrative restrictions and gain unauthorized read access to sensitive module settings and associated entity data.\nThis issue exposes sensitive internal configuration details, which may include metadata or system entity information intended for super-admin eyes only.\nThe impact is primarily categorized as an information disclosure flaw; while the vulnerability does not permit the modification of system settings, it facilitates the unauthorized extraction of system-level data.\nThe vulnerability affects Xibo versions prior to 4.4.3.\nSuccessful exploitation requires that an attacker holds a valid user account that has been explicitly granted the 'Module View' permission. While this permission is not assigned by default to standard users, it presents a significant risk in environments where delegated administrative or monitoring roles exist.\nRemediation requires upgrading the platform to version 4.4.3, which introduces the necessary authorization checks, or restricting access to the 'Module View' feature to trusted administrative personnel.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient access control check within the Module::settingsForm function of the Xibo CMS application. The function fails to validate whether the authenticated user possesses the 'Super Admin' role or appropriate super-administrative privileges before processing requests to display module configuration forms.\nIn the Xibo architecture, the Module::settingsForm function is responsible for rendering the administrative interface for managing specific module parameters. Due to the missing authorization gate, any user account that has been granted the 'Module View' permission can invoke this function to render the settings interface for modules they would otherwise be restricted from accessing.\nThe attack flow proceeds as follows: An attacker with a low-privileged account possessing 'Module View' permissions initiates a request to the server, targeting the specific endpoint mapped to Module::settingsForm. Because the application logic relies on client-side or partial server-side validation that does not explicitly verify the super-admin status, the backend server processes the request and returns the full module entity data and configuration settings to the attacker's session.\nThe technical impact results in the leakage of full module entity information, which can include internal database structures, configuration keys, or proprietary integration parameters managed through the CMS. This information can be leveraged to gain deep insight into the system's underlying architecture, potentially facilitating further exploitation attempts or reconnaissance.\nThe vulnerability is restricted to versions prior to 4.4.3. The security flaw exists within the server-side code responsible for managing module configuration lifecycle. There is no indication of remote code execution or unauthorized modification of these settings; the exploitation is limited to the unauthorized reading of sensitive module configuration data provided during the form-rendering phase.\nExploitation does not require elevated network access beyond what is standard for an authenticated CMS user; however, it strictly requires the presence of the 'Module View' privilege, which limits the attack surface to authorized users within the system. Once the attacker triggers the form rendering, the application unknowingly discloses privileged configuration data directly within the rendered output provided to the attacker's interface."
}