AzuraCast versions prior to 0.23.6 have a missing permissions check on the media file download endpoint GET /api/station/{station_id}/file/{id}/play. This flaw allows any authenticated user to download media files from any station, regardless of their permissions, enabling cross-station media exfiltration in multi-tenant deployments. The vulnerability arises because the /play route lacks the Permissions middleware that protects other file-related endpoints. Media IDs are auto-incremented, making enumeration and unauthorized access trivial. A fix is available in version 0.23.6.