CVE-2026-121427

The record

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

Affected packages

Related vulnerabilities

• CVE-2026-121614 Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled… CWE-15
• CVE-2026-73027 External control of system or configuration setting in Windows Setup Files Cleanup allows… CWE-15
• CVE-2026-107818 MariaDB server is a community developed fork of MySQL server. CWE-15
• CVE-2026-87987 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CWE-15
• CVE-2026-85217 A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can… CWE-15
• CVE-2026-19592 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CWE-15
• CVE-2026-16708 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive… CWE-15
• CVE-2026-19884 In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source… CWE-15