CVE-2026-50541Published
Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-50541 · Microsoft / collected KEV context
cve-program · CVE-2026-50541
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6xr-pmg9-qpmv
- https://github.com/xibosignage/xibo-cms/pull/3493
- https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556
- https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b
- https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3
- https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta
Related operational evidence
Explicit CVE identifiers- Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export · Newly collected advisory · 28 Oct 2026