CVE-2026-121427

HighCVSS 7.5/10Last modified Nov 9, 2026

Description

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-15

Affected software

No affected versions have been published.

Timeline

Published
Nov 3, 2026
Last modified
Nov 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1214288.8AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor confCVE-2026-1214298.8AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commandsCVE-2026-121437.5form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#appenCVE-2026-1214305.4AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} rouCVE-2026-1214315.3AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass thCVE-2026-1214323.5AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embeddCVE-2026-1214335.4AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist forCVE-2026-1214345.4Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do noCVE-2026-1214354.3Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by callinCVE-2026-1214367.2Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view CVE-2026-1214377.5Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-timCVE-2026-1214385.3Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU grow
CVE-2026-121427: High severity, CVSS 7.5 | Vulnix