A missing permission check in the GET /api/station/{station_id}/file/{id}/play endpoint permits any authenticated AzuraCast user to download media files belonging to other stations. By iterating numeric IDs the attacker can enumerate and exfiltrate an entire unprotected media library, exposing potentially copyrighted or sensitive content. The flaw stems from a lack of access control validation, directly compromising confidentiality of station assets.

The vulnerability affects AzuraCast installations running any version prior to 0.23.6. Users of earlier AzuraCast releases must verify whether their installation matches this range, or otherwise adopt an updated release.

The CVSS score of 7.1 classifies the issue as high severity, and the absence of an EPSS rating indicates that exploitation probability has not been quantified. The vulnerability is not yet listed in the CISA KEV catalog. Attackers only need authenticated access, then can enumerate sequential media identifiers to harvest full station libraries. No additional privileges or network services are required beyond standard API usage.