What is GHSA-rwfr-jcqg-x7jc?

GHSA-rwfr-jcqg-x7jc is a security advisory published by GitHub Security Advisories with High severity. AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station...

Which CVE IDs does GHSA-rwfr-jcqg-x7jc cover?

GHSA-rwfr-jcqg-x7jc covers the following CVE IDs: CVE-2026-100855. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rwfr-jcqg-x7jc?

GHSA-rwfr-jcqg-x7jc has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-rwfr-jcqg-x7jcHighCVSS 6.5

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station...

Vendor

GitHub Security Advisories

Published

September 27, 2026

Last Modified

September 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-100855 →

📋 Description

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations they lack permissions for.

🔗 References (4)

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qff7-q5fm-8p76
https://nvd.nist.gov/vuln/detail/CVE-2026-100855
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-missing-permission-check-via-play
https://github.com/advisories/GHSA-rwfr-jcqg-x7jc