PT-2026-34814 · Xibo · Xibo

Lighthouse Keeper · CVE-2026-31956 · Published 2026-04-24 · Updated 2026-04-25

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xibo versions prior to 4.4.1

Description An authenticated user can manually construct a URL to preview campaigns or regions and export saved reports belonging to other users. This is possible for authorized users with privileges to access pages for Layout Management, Campaign Management, or Saved Reports.

Recommendations Upgrade to version 4.4.1.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-31956

GHSA-Q6RV-8HHJ-3FR8

Affected Products

Xibo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31956.json · Exploit
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-q6rv-8hhj-3fr8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31956 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31956 · Security Note
• https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1 · Note
• https://twitter.com/infoflowcloud/status/2048101214517150053 · Twitter Post
• https://twitter.com/CVEnew/status/2048099343316467744 · Twitter Post