Xibo CMS Preview and Export Vulnerability Allowing Unauthorized Report Access

A vulnerability in Xibo CMS, an open-source digital signage platform, allows authenticated users to access and export reports belonging to other users. This issue affects versions of Xibo CMS through 4.4.0. The vulnerability arises from the ability to manually construct URLs to preview campaigns or regions and export saved reports, exploiting a lack of proper authorization checks at the controller level. Users with privileges to manage layouts, campaigns, or reports can exploit this vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized access to and export of reports belonging to other users.

Remediation

Users should upgrade to Xibo CMS version 4.4.1, which addresses this vulnerability.