Improper Neutralization of Special Elements in Data Query Logic in AzuraCast - CVE-2026-100847
Published: October 25, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information, including administrator usernames, email addresses, password hashes, and station settings.
The vulnerability exists due to improper neutralization of special elements in data query logic in AzuraCast's backend/src/Controller/Api/Stations/AbstractSearchableListAction.php when processing the sortOrder GET parameter and passing it directly to addOrderBy(). A remote attacker can submit crafted requests to the station requests API with query parameters such as sort=genre&sortOrder=asc,%20CASE%20WHEN%20EXISTS(SELECT%201%20FROM%20App%5CEntity%5CUser%20u%20WHERE%20u.id=1)%20THEN%20sm.id%20ELSE%20(0-sm.id)%20END to inject DQL expressions and infer sensitive database contents from changes in result ordering.