Skip to content
Threat Feed
Subscribe
high advisory

AzuraCast DQL Injection Vulnerability in sortOrder Parameter

AzuraCast versions prior to 0.23.8 are vulnerable to a DQL injection flaw in the sortOrder API parameter, allowing attackers to exfiltrate sensitive database contents.

CVE search metadata

CVE search record: CVE-2026-100847. Severity: high. CVSS: 7.5. KEV: no. Product: AzuraCast (< 0.23.8), AzuraCast (<= 0.23.x), AzuraCast (< 0.23.6). Brief: AzuraCast DQL Injection Vulnerability in sortOrder Parameter. Brief link: https://feed.craftedsignal.io/briefs/2026-09-azuracast-dql-injection/

What's new

  • 1. added coverage for AzuraCast (< 0.23.6) Sep 27, 03:06 via nvd
  • 2. added coverage for AzuraCast (<= 0.23.x) Sep 27, 03:06 via nvd
  • 3. added detection rule: Detect Exploitation of CVE-2026-100851 - Broken Access Control in AzuraCast Sep 27, 03:06 via nvd
  • 4. added detection rule: Detect CVE-2026-100850 - AzuraCast SSRF and Local File Read Sep 27, 03:06 via nvd
  • 5. added detection rule: Detect CVE-2026-100849 Exploitation - Unauthorized Webhook Test Request Sep 27, 03:05 via nvd

AzuraCast versions before 0.23.8 are susceptible to a DQL injection vulnerability located within the 'sortOrder' API parameter of the 'AbstractSearchableListAction.php' file. An attacker can exploit this flaw by supplying specially crafted DQL (Doctrine Query Language) expressions via the 'sortOrder' parameter. Successful exploitation permits the attacker to bypass standard query logic, potentially leading to the unauthorized exfiltration of sensitive information from the application's database, including user credentials and station configuration settings. This vulnerability presents a significant risk to the integrity and confidentiality of the AzuraCast environment. Organizations should prioritize updating to version 0.23.8 or later to mitigate this risk.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to query and extract sensitive database contents. This could lead to the exposure of administrative user credentials and specific stream/station configuration data, potentially facilitating full application compromise or unauthorized control over broadcast settings.

Recommendation

Update all AzuraCast instances to version 0.23.8 or later immediately to patch CVE-2026-100847. Detection engineering teams should monitor web access logs for anomalous, high-entropy content or SQL/DQL-like syntax (e.g., SELECT, FROM, JOIN, WHERE) within the 'sortOrder' query parameter of API requests.

Immediate actions

Upgrade AzuraCast to version 0.23.8 or later.

IT Operations 48h

Mitigations

Upgrade AzuraCast to version 0.23.8 or later.

immediate IT Operations

CVE-2026-100847

Detection coverage 4

Detects CVE-2026-100847 Exploitation - DQL Injection Attempt

high

Detects exploitation attempts against the AzuraCast sortOrder parameter by identifying DQL-specific keywords and characters in web requests.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detect CVE-2026-100849 Exploitation - Unauthorized Webhook Test Request

high

Detects exploitation attempts against the AzuraCast test webhook endpoint, which can be abused to perform SSRF when coupled with malformed URL inputs.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detect CVE-2026-100850 - AzuraCast SSRF and Local File Read

high

Detects exploitation of CVE-2026-100850 by monitoring requests to the station queue API that contain indicators of local file path traversal or internal URI schemes.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detect Exploitation of CVE-2026-100851 - Broken Access Control in AzuraCast

high

Detects potential exploitation attempts by monitoring for requests to the vulnerable API endpoint profile which leaks administrative credentials.

sigma tactics: credential_access techniques: T1552 sources: webserver

Detection queries are available on the platform. Get full rules →