Centreon postcommand.php lets non-admin users run poller post-restart commands
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Centreon from 25.10 before centreon-web-25.10.9, from 24.10 before centreon-web-24.10.21, and from 24.04 before centreon-web-24.04.25 is affected. Missing function-level authorization checks in postcommand.php let an authenticated user who is not an administrator run poller post-restart commands. An attacker with low privileges on the network can affect the integrity and availability of the system, and no user interaction is needed.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Centreon | Centreon | 25.10 to before centreon-web-25.10.9; 24.10 to before centreon-web-24.10.21; 24.04 to before centreon-web-24.04.25 | centreon-web-25.10.9, centreon-web-24.10.21, centreon-web-24.04.25 | Patch available | CNA |
- Centreon VendorCentreon Affected 25.10 to before centreon-web-25.10.9; 24.10 to before centreon-web-24.10.21; 24.04 to before centreon-web-24.04.25 Fixed in centreon-web-25.10.9, centreon-web-24.10.21, centreon-web-24.04.25 Patch available CNA
Remediation
Upgrade Centreon to centreon-web-25.10.9, centreon-web-24.10.21, or centreon-web-24.04.25, depending on the installed branch.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA Centreon (Centreon) Fixed in centreon-web-25.10.9, centreon-web-24.10.21, centreon-web-24.04.25
Timeline
- 2026-10-29 Threatist record created from CVE-2025-13050
- 2026-10-29 Alias added: GHSA-g72r-v5vg-h84w
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
References
More Centreon vulnerabilities
- TI-2022-19661 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20634 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20632 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20630 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20629 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2024-00588 SQL injection in Centreon CVSS 3.0HIGH 8.8
Sources
- CVE-2025-13050 · CVE Program
- CVE-2025-13050 · NVD
- FIRST EPSS
- GHSA-g72r-v5vg-h84w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences