CVE-2026-100853

Published: Sep 27, 2026Modified: Sep 28, 2026Deferred

8.2

Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q9cc-mp52-vrp9

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/azuracast-before-0.23.8-on-demand-download-endpoint-authorization-bypass

Source: disclosure@vulncheck.com

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q9cc-mp52-vrp9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.