CVE-2026-100855: AzuraCast before 0.23.6 Missing Permission Check via /play

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-10-08
Weakness: CWE-862

Description

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations they lack permissions for.

Affected products

AzuraCast: before 0.23.6 — fixed in 0.23.6

How to fix

Upgrade to a fixed version: AzuraCast 0.23.6. Check the vendor advisory for mitigations.

References

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qff7-q5fm-8p76
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-missing-permission-check-via-play

Get alerted when CVE-2026-100855 or the next vulnerability affects your stack