Xibo CMS suffers from an insecure direct object reference (IDOR) due to a missing controller-level authorization check. Any authenticated user can craft URLs to preview campaigns or regions and to export saved reports that belong to other users. The exposure is a result of the disableUserCheck bypass and falls under CWE-639, allowing unintended information disclosure.

The affected product is Xibo CMS by XiboSignage, specifically versions prior to 4.4.1. Users relying on earlier releases are vulnerable until they apply the updated version.

Based on the CVSS score of 4.3, the vulnerability is classified as moderate severity. The EPSS score of < 1% indicates a low probability of exploitation in the wild, and the issue is not listed in CISA's KEV catalog. Exploitation requires a legitimate user with layout, campaign, or report management permissions; by manually constructing a request URL, the attacker can retrieve content from other users, enabling unauthorized data disclosure. The attack vector is web-based, relying on authenticated HTTP requests.