CVE-2026-100855

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations they lack permissions for.

Score

CVSS 4.0 7.1 High

Status

Deferred - disclosure@vulncheck.com

Published

2026-09-27

Last modified

2026-10-08

Weaknesses

CWE-862

Affected products

• Azuracast (Azuracast)

References

• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qff7-q5fm-8p76
• https://www.vulncheck.com/advisories/azuracast-before-0.23.6-missing-permission-check-via-play