CVE-2026-100851

AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile

State: Published
Severity: 7.2 High
Published: Sep 27, 2026
Updated: Sep 30, 2026
Reserved: Sep 27, 2026

Description

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this endpoint and receive plaintext frontend credentials in the JSON response, then use the admin password to authenticate to the Icecast admin interface without Broadcasting permission.

Scores

CVSS	Score	Vector	Source
4.0	7.2 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L	VulnCheck

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
AzuraCastAzuraCast	before 0.23.8Affected 0.23.8Not affected

References

GitHub Security Advisory (GHSA-qwh6-x463-ccf4)vendor-advisory
VulnCheck Advisory: AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profilethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.