Cloudanix VulnDB

GHSA-qff7-q5fm-8p76

Medium · 6.5

AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

CVSS

6.5

EPSS

—

Published

May 4, 2026

CISA due date

—

The record

The `GET /api/station/{station_id}/file/{id}/play` endpoint, handled by `PlayAction`, is missing the `Middleware\Permissions` check that protects all sibling routes in the same `/file/{id}` route group. Any authenticated user can download media files from any station, regardless of whether they have permissions on that station. In multi-tenant deployments, this enables cross-station media exfiltration.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities