The vulnerability is a missing authorization check on the POST /displaygroup/criteria/{displayGroupId} endpoint of the Xibo CMS web interface. This flaw allows an authenticated CMS user to inject arbitrary scheduling criteria via XMR, which can modify the playback schedule of player devices. As a result, an attacker could cause content that is normally scheduled only for certain weather conditions to play regardless of the actual conditions, undermining the integrity of the signage schedule.

The affected product is Xibo Signage’s Xibo CMS, with all releases prior to version 4.4.3 being vulnerable. The issue is tied to the use of Schedule Criteria within the CMS; any installation using this feature before the 4.4.3 update is considered at risk.

The CVSS score of 4.3 reflects a moderate severity, and the lack of a publicly listed KEV and unspecified EPSS suggests that exploitation is currently unlikely but still plausible. The attacker needs authenticated access to the CMS, but no authorization check on the specific endpoint permits privilege escalation within the CMS’s scheduling capabilities. Because the flaw is contained to CMS users, limiting privilege or applying the patch mitigates the risk.