CVE-2026-76836: AzuraCast Liquidsoap Configuration RCE

CVE-2026-76836 Overview

AzuraCast exposes Liquidsoap custom configuration fields through an API endpoint that lacks proper permission enforcement. The PUT /api/station/{station_id}/profile/edit endpoint deserializes the backend_config property using the GROUP_GENERAL serialization group while requiring only StationPermissions::Profile. This allows station managers with profile-editing rights to write Liquidsoap .liq script contents that are normally reserved for broadcasting operators. When the backend restarts, the injected configuration is executed by Liquidsoap's process.run() and process.exec() built-ins, resulting in arbitrary operating system command execution [CWE-94].

Critical Impact
Authenticated users with only the Profile permission can inject arbitrary shell commands into the generated Liquidsoap configuration, achieving code execution on the AzuraCast host when the backend restarts.

Affected Products

AzuraCast self-hosted web radio management suite
AzuraCast release 0.23.8 (source references confirm the vulnerable code path)
Deployments exposing the station profile API to non-broadcasting station managers

Discovery Timeline

2026-08-24 - CVE-2026-76836 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76836

Vulnerability Analysis

The flaw is a serialization group bypass that collapses AzuraCast's permission boundary between profile management and broadcasting operations. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL. The controller backend/src/Controller/Api/Stations/ProfileEditController.php handles PUT /api/station/{station_id}/profile/edit and deserializes incoming payloads under that same group while checking only StationPermissions::Profile.

The AbstractArrayEntity::fromArray() helper then assigns every public property present in the payload with no field-level authorization check. This exposes custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade, and custom_config_bottom to any caller who can reach the profile endpoint. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, correctly requires StationPermissions::Broadcasting, confirming the intended boundary.

Root Cause

The root cause is a mismatch between object-level authorization and field-level serialization scope. AzuraCast enforces authorization at the endpoint layer only, while the serialization group GROUP_GENERAL grants write access to sensitive backend configuration fields that require a stricter permission. Missing field-level permission checks in AbstractArrayEntity::fromArray() allow every public property of the Station entity to be overwritten.

Attack Vector

An authenticated station manager holding only the Profile permission sends a PUT request to /api/station/{station_id}/profile/edit with a backend_config object containing malicious custom_config_* values. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script. When the built-in sync task detects that needs_restart has been set, it restarts the backend automatically, and Liquidsoap evaluates the injected process.run() or process.exec() calls to execute operating system commands under the AzuraCast service account.

See the GitHub Security Advisory GHSA-q8wg-3qg7-8pc7 and the VulnCheck Advisory on AzuraCast for the deserialization flow and reproduction detail.

Detection Methods for CVE-2026-76836

Indicators of Compromise

Unexpected process.run( or process.exec( strings in generated Liquidsoap .liq scripts under the station configuration directory.
PUT /api/station/{station_id}/profile/edit requests whose JSON body contains a backend_config object with any custom_config* field populated by non-broadcasting users.
Backend restart events (needs_restart transitions) that immediately follow a profile edit by an account without Broadcasting permission.
Outbound network connections, reverse-shell processes, or new cron entries owned by the AzuraCast service user after a station profile save.

Detection Strategies

Correlate AzuraCast application logs of profile edits with the effective diff of custom_config_* fields in the emitted Liquidsoap configuration.
Alert on any Liquidsoap script write that introduces process.run or process.exec and was not generated from /api/station/{id}/liquidsoap-config.
Monitor process ancestry: shell processes (sh, bash, python) spawned by the Liquidsoap process are a high-fidelity signal of code injection.

Monitoring Recommendations

Enable request-body logging on the AzuraCast reverse proxy for station profile endpoints, redacting credentials but retaining backend_config keys.
Track file integrity on the generated .liq scripts and station configuration directories.
Forward AzuraCast, Liquidsoap, and host process telemetry to a centralized SIEM for cross-source correlation.

How to Mitigate CVE-2026-76836

Immediate Actions Required

Restrict network access to the AzuraCast administrative API so only trusted operators can reach /api/station/{station_id}/profile/edit.
Audit all station-scoped accounts and revoke the Profile permission from users who do not require it.
Review generated Liquidsoap .liq scripts for unexpected process.run or process.exec calls and roll back any tampered configuration.
Rotate credentials, API tokens, and any secrets accessible to the AzuraCast service account if injection is suspected.

Patch Information

At the time of publication, the NVD record for CVE-2026-76836 does not list fixed version information. Consult the GitHub Security Advisory GHSA-q8wg-3qg7-8pc7 and the AzuraCast GitHub Repository for the current fixed release and upgrade instructions. Upgrade AzuraCast to the vendor-designated fixed version once available.

Workarounds

Limit assignment of StationPermissions::Profile to accounts that already hold StationPermissions::Broadcasting, aligning field access with the stricter boundary.
Place the AzuraCast API behind an authenticating reverse proxy or VPN to reduce the attack surface for authenticated abuse.
Add a web application firewall rule that blocks PUT requests to /api/station/*/profile/edit containing custom_config keys in the JSON body until patched.
Monitor and alert on modifications to the backend_config field in the AzuraCast database as a compensating control.

bash

# Example WAF rule (ModSecurity) to block custom_config in profile edits
SecRule REQUEST_METHOD "@streq PUT" \
  "chain,phase:2,deny,status:403,id:1026768360,\
   msg:'CVE-2026-76836 AzuraCast profile edit custom_config block'"
  SecRule REQUEST_URI "@rx ^/api/station/[0-9]+/profile/edit$" \
    "chain"
    SecRule REQUEST_BODY "@rx \"custom_config(_top|_pre_playlists|_pre_live|_pre_fade|_bottom)?\"\\s*:" \
      "t:none"