AzuraCast versions prior to 0.23.6 have a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint. This flaw allows authenticated users to download media files from any station, including those they do not have permission to access. Attackers can enumerate media files using sequential IDs and exfiltrate entire media libraries of unauthorized stations.