The vulnerability is an IDOR flaw in the "GET /layout/status/{id}" endpoint, allowing any authenticated user, regardless of their privileges, to retrieve status and metadata for arbitrary layouts. This can expose sensitive information such as layout schedules, associated devices, or organisational data, thereby compromising confidentiality of the digital signage content.

Xibo Signage Xibo CMS versions prior to 4.4.3 are affected. Users running any version before the 4.4.3 release may exploit the missing access‑control check.

The CVSS score of 5.4 indicates a moderate severity. EPSS data is not available, so the probability of exploitation cannot be quantified, and it is not listed in the CISA KEV catalog. The flaw requires authenticated access; an attacker must be logged into the CMS with any role and can then retrieve metadata for any layout by altering the {id} path component. Given the straightforward nature of the attack and the lack of mitigation in earlier releases, the risk to confidential data is considerable for systems with broad user access.