AzuraCast up to version 0.23.8 has a serialization group bypass that allows a user with only station profile permission to write arbitrary Liquidsoap configuration values. The configuration includes fields that are emitted verbatim into a Liquidsoap .liq script, where built‑ins such as process.run() and process.exec() can execute arbitrary operating system commands when the backend restarts. This flaw, identified as a combination of improper access control (CWE‑863) and code injection (CWE‑94), gives the attacker the ability to run arbitrary commands on the hosting machine, compromising confidentiality, integrity, and availability of the system.

The vulnerability affects AzuraCast, specifically all releases up to and including 0.23.8. Users deploying these versions expose themselves to the described risk.

The CVSS score of 8.7 classifies this flaw as high severity, and the flaw is not listed in the CISA KEV catalog yet. Although no EPSS score is provided, the attack path is straightforward for any authenticated user who holds the StationPermissions::Profile for a station, a privilege that is commonly granted. The exploit requires only the ability to send a PUT request to /api/station/{station_id}/profile/edit; upon setting the needs_restart flag, the backend automatically restarts the Liquidsoap instance, triggering the malicious command execution. No additional privileges beyond the standard station manager role are required.