CVE-2026-100855 - AzuraCast before 0.23.6 Missing Permission Check via /play

Back Back to CVE browser

HIGH

AzuraCast before 0.23.6 Missing Permission Check via /play

Published Sep 27, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.21%

Description

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations they lack permissions for.

Affected products

Vendor AzuraCast Product AzuraCast Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <0.23.6
- Version
  0.23.6
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

AzuraCast

unaffected

Version	Status	Constraints
0	affected	<0.23.6
0.23.6	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87820
Advisory
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qff7-q5fm-8p76
vendor-advisory
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-missing-permission-check-via-play
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87820		Advisory
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qff7-q5fm-8p76		vendor-advisory
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-missing-permission-check-via-play		third-party-advisory