Missing authorization in Centreon users configuration endpoint
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Centreon versions from 24.10 before centreon-web-25.10.6, from 24.04 before centreon-web-24.10.21, and from 25.10.x before centreon-web-24.04.25 are affected. A missing authorization check (CWE-862) in the users configuration endpoint exposes sensitive information to users who are logged in. An authenticated user with low privileges can read this data over the network.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Centreon | Centreon | 24.10 to before centreon-web-25.10.6; 24.04 to before centreon-web-24.10.21; 25.10.x to before centreon-web-24.04.25 | centreon-web-25.10.6, centreon-web-24.10.21, centreon-web-24.04.25 | Patch available | CNA |
- Centreon VendorCentreon Affected 24.10 to before centreon-web-25.10.6; 24.04 to before centreon-web-24.10.21; 25.10.x to before centreon-web-24.04.25 Fixed in centreon-web-25.10.6, centreon-web-24.10.21, centreon-web-24.04.25 Patch available CNA
Remediation
Centreon fixes this in centreon-web-25.10.6, centreon-web-24.10.21 and centreon-web-24.04.25. The sources list no further advisory identifiers.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA Centreon (Centreon) Fixed in centreon-web-25.10.6, centreon-web-24.10.21, centreon-web-24.04.25
Timeline
- 2026-10-29 Threatist record created from CVE-2025-12523
- 2026-10-29 Alias added: GHSA-v74m-5mxp-fcrr
- 2026-10-31 Priority changed: MEDIUM → LOW
References
More Centreon vulnerabilities
- TI-2022-19661 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20634 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20632 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20630 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2022-20629 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2024-00588 SQL injection in Centreon CVSS 3.0HIGH 8.8
Sources
- CVE-2025-12523 · CVE Program
- CVE-2025-12523 · NVD
- FIRST EPSS
- GHSA-v74m-5mxp-fcrr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences