CVE-2026-100855 AzuraCast CVE debrief

Who should care

Defenders responsible for AzuraCast installations, particularly those with multi-station setups or sensitive media content, should assess exposure and prioritize verification and compensating controls.

Why it matters

CVE-2026-100855 is a high-severity vulnerability in AzuraCast that allows authenticated users to download media files from any station due to a missing permission check. Defenders should prioritize verifying exposure, assessing compensating controls, and monitoring for potential media file exfiltration attempts.

• Potential media file exfiltration by authenticated users
• Lateral movement within multi-station AzuraCast deployments
• Increased risk of unauthorized access to sensitive media content
• Need for verification of AzuraCast version and configuration

Technical summary

The GET /api/station/{station_id}/file/{id}/play endpoint in AzuraCast before 0.23.6 lacks a permission check, allowing authenticated users to download media files from any station by enumerating media files using sequential IDs. This vulnerability affects multi-station setups and those with sensitive media content. Defenders should prioritize verifying exposure and assessing compensating controls for authenticated users with limited permissions. The vulnerability allows for potential media file exfiltration and lateral movement within multi-station AzuraCast deployments.

Defensive priority

Defenders should prioritize verifying exposure and assessing compensating controls for authenticated users with limited permissions.

Recommended defensive actions

• Verify exposure by checking AzuraCast versions and configurations
• Assess compensating controls for authenticated users with limited permissions
• Monitor for potential media file exfiltration attempts
• Review vendor advisory for AzuraCast
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the missing permission check vulnerability in AzuraCast before 0.23.6. Evidence is limited to the information provided in these sources. Defenders should verify the AzuraCast version and configuration to assess exposure. The vulnerability allows authenticated users to download media files from any station by enumerating media files using sequential IDs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.