CVE-2026-76836
AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
Description
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.
INFO
Published Date :
Aug. 24, 2026, 6:17 p.m.
Last Modified :
Oct. 13, 2026, 9:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Restrict access to profile editing API endpoint.
- Require appropriate permissions for editing Liquidsoap config.
- Validate all user inputs to prevent command injection.
- Update software to patch access control vulnerabilities.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-76836.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-76836 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-76836
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-76836 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-76836 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 13, 2026
Action Type Old Value New Value Added Translation Title: AzuraCast, Description: AzuraCast expone los campos de configuración personalizados de Liquidsoap a través de un endpoint que no requiere el permiso que los protege. La propiedad backend_config en backend/src/Entity/Station.php está anotada con GROUP_GENERAL, y PUT /API/station/{station_id}/profile/edit en backend/src/Controller/Api/Stations/ProfileEditController.php deserializa con ese grupo mientras que requiere solo StationPermissions::Profile. AbstractArrayEntity::fromArray() luego asigna cada propiedad pública sin una verificación de permiso a nivel de campo, por lo que custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade y custom_config_bottom son escribibles a través de él. ConfigWriter::writeCustomConfigurationSection() emite esos valores textualmente en el script .liq de Liquidsoap generado, donde las funciones integradas process.run() y process.exec() ejecutan comandos del sistema operativo cuyo el backend se reinicia, lo cual la tarea de sincronización integrada activa automáticamente una vez que needs_restart está establecido. El endpoint dedicado para los mismos datos, PUT /API/station/{id}/liquidsoap-config, requiere StationPermissions::Broadcasting, por lo que un administrador de estación que posee solo el permiso de perfil alcanza una configuración que el límite previsto reserva para operadores de transmisión. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added Reference https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q8wg-3qg7-8pc7 Added SSVC {'id': 'CVE-2026-76836', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-24T19:58:47.846106Z'} -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/AzuraCast/AzuraCast', 'vendor': 'AzuraCast', 'product': 'AzuraCast', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '0.23.8'}], 'packageURL': 'pkg:github/AzuraCast/AzuraCast', 'defaultStatus': 'unaffected'}] Added Description AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-94 Added CWE CWE-863 Added Reference https://github.com/AzuraCast/AzuraCast Added Reference https://github.com/AzuraCast/AzuraCast/blob/0.23.8/backend/src/Entity/Station.php Added Reference https://github.com/AzuraCast/AzuraCast/blob/0.23.8/backend/src/Radio/Backend/Liquidsoap/ConfigWriter.php Added Reference https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q8wg-3qg7-8pc7 Added Reference https://www.vulncheck.com/advisories/azuracast-through-liquidsoap-configuration-write-via-profile-edit-serialization-group-bypass