CVE-2026-100855CWE-862broken-access-control

CVE-2026-100855

Medium · published September 27, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations they lack permissions for.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00209 · 10.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-27T06:17Z
References (2)
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qff7-q5fm-8p76 · [email protected]https://www.vulncheck.com/advisories/azuracast-before-0.23.6-missing-permission-check-via-play · [email protected]
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 27 SEP 01:28Z
    AzuraCast before 0.23.6 Missing Permission Check via /play
    cvelistv5