The vulnerability arises from a missing object‑level authorization check on the /notification/export/{id} endpoint, allowing any authenticated user to download attachments associated with any notification. An attacker only needs to know or iterate sequential notification identifiers; the action does not grant elevated privileges beyond the existing user role. The result is a confidentiality breach where non‑administrative staff may access files that were intended for administrators only.

Any Xibo CMS installation running a version prior to 4.4.3 is affected. The issue was fixed in release 4.4.3 and later versions, regardless of operating system or deployment topology.

With a CVSS score of 6.5, the vulnerability presents moderate severity. The EPSS score is not available and the item is not listed in the CISA KEV catalog, suggesting low current exploitation momentum. The attack vector is authenticated; an attacker needs only a valid user account and access to the Notification Centre, a capability granted to standard users. Exploitation requires no special privileges or complex conditions beyond enumerating notification IDs, which can be done manually or via automated scripts.