CVE-2026-121427

{
  "etk_id": "ETK-2026-3373",
  "cve_id": "CVE-2026-121427",
  "display_id": "CVE-2026-121427",
  "ghsa_id": "GHSA-jv23-j2cr-92x9",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Shoutcast configuration injection in AzuraCast",
  "summary": "AzuraCast through 0.23.8 can allow authenticated users with the Manage station profile permission to place untrusted settings into a station's Shoutcast configuration. An attacker with that permission can change Shoutcast credentials or networking settings, or add configuration directives, potentially taking control of the station frontend.",
  "mitigation": "Restrict the Manage station profile permission to trusted administrators and review Shoutcast configuration and credentials for affected stations. Remove unexpected settings and rotate Shoutcast credentials where untrusted users previously held that permission.",
  "vendor": "AzuraCast",
  "product": "AzuraCast",
  "affected": [
    {
      "affected_notes": [
        "rolling main through ebf75a2 (verified ebf75a267fd2113c1c1b881c04a58babdf4356d3)"
      ],
      "affected_ranges": [
        "<= 0.23.8"
      ],
      "ecosystem": "composer",
      "fixed_versions": [],
      "package_name": "azuracast/azuracast",
      "purl": "pkg:composer/azuracast/azuracast"
    }
  ],
  "cwes": [
    15
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.809308433333335,
  "t0_at": "2026-11-03T14:28:22.192000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T14:28:22.192000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T14:28:22.192000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121427"
    }
  }
}