CVE-2026-100855

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.6

Description An issue exists where a missing permission check in the 'GET /api/station/{station id}/file/{id}/play' endpoint allows authenticated users to download media files from any station. This can be exploited by enumerating media files using sequential IDs to exfiltrate the complete media library of stations for which the user lacks proper permissions.

Recommendations Update to version 0.23.6 or later. Restrict access to the 'GET /api/station/{station id}/file/{id}/play' endpoint to minimize the risk of unauthorized file downloads.