Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-100855AzuraCast before 0.23.6 Missing Permission Check via /play

Medium 6.5

In plain English

A medium-severity missing authorization in AzuraCast from AzuraCast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 88.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations they lack permissions for.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	azuracast/azuracast	0.23.6	GHSA-qff7-q5fm-8p76

Affected products (as reported)

Vendor	Product	Versions
AzuraCast	AzuraCast	0 – before 0.23.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-qff7-q5fm-8p76) vendor-advisory
VulnCheck Advisory: AzuraCast before 0.23.6 Missing Permission Check via /play third-party-advisory