CVE-2026-52729Published
Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-52729 · Microsoft / collected KEV context
cve-program · CVE-2026-52729
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7j3h-48f7-w4fr
- https://github.com/xibosignage/xibo-cms/pull/3492
- https://github.com/xibosignage/xibo-cms/commit/96d7b458781b8cd10e64788565fbdeffd15f08cf
- https://github.com/xibosignage/xibo-cms/commit/efd13abf868e2386f40929ed6e4f36fead310f20
- https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3
- https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta
Related operational evidence
Explicit CVE identifiers- Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion · Newly collected advisory · 28 Oct 2026