CVE-2026-121430
Deferred Deferred - Pending Action

AzuraCast Missing Authorization in Waveform API

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121430
EUVD
EUVD-2026-115852

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AzuraCast AzuraCast 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AzuraCast before version 0.24.0 has a missing authorization vulnerability in specific API routes. The GET and POST endpoints for /api/station/{station_id}/waveform/{media_id} do not enforce proper permissions. This allows any authenticated user without station assignment to read another station's cached waveform JSON data and overwrite it with malicious data, which corrupts the Visual Cue Editor data.

Impact Analysis

An attacker could exploit this to access sensitive waveform data from other stations, disrupt station operations by corrupting visual cues, or manipulate data to mislead users. It requires an authenticated user without direct station access, making it a risk for multi-user deployments.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Exposure of waveform data may constitute a breach depending on the content, requiring investigation and possible notifications under these regulations.

Mitigation Strategies

Update AzuraCast to version 0.24.0 or later to address the missing authorization vulnerability in the waveform routes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...