{"id":"CVE-2026-121430","published":"2026-11-03T15:17:33.910","lastModified":"2026-11-03T15:17:34.033","description":"AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q3x9-qgv6-hgq3","tags":[]},{"url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-missing-authorization-via-station-waveform-endpoints","tags":[]}],"exploitRefs":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q3x9-qgv6-hgq3","tags":[]}],"hasPoc":true,"ai":null}