CVE-2026-76836
Received Received - Intake

AzuraCast Liquidsoap Configuration Command Injection

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76836
EUVD
EUVD-2026-65008

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
azuracast azuracast 0.23.8
azuracast azuracast From 0.23.8 (exc)
azuracast azuracast to 0.23.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in AzuraCast allows users with only 'manage station profile' permission to inject malicious OS commands into Liquidsoap configuration fields via an improperly secured API endpoint. The injected commands execute when the backend restarts automatically, granting attackers full system control.

Detection Guidance

Check AzuraCast logs for unauthorized modifications to Liquidsoap configuration files or suspicious entries in custom_config fields. Inspect API requests to PUT /api/station/{station_id}/profile/edit for unusual activity. Verify if users with only profile permissions have accessed restricted endpoints.

Impact Analysis

An attacker could gain full control over your AzuraCast server, execute arbitrary commands, steal sensitive data like API keys, or disrupt radio station operations. The attack requires only a valid API key with limited permissions, making it accessible to station managers.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized modifications, or disclosure of protected health information.

Mitigation Strategies

Upgrade AzuraCast to a patched version. Remove custom_config fields from GROUP_GENERAL serialization. Restrict access to PUT /api/station/{station_id}/profile/edit. Monitor for unauthorized restarts of Liquidsoap backend.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76836. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart