CVE-2025-4649 Missing authorization in web
Attackers can view all event logs despite lacking high privileges due to incorrect ACL handling, leading to information disclosure and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4649?
CVE-2025-4649 is a medium-severity missing authorization vulnerability in Centreon Centreon Web, published on 13 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation.
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26.
Weakness: CWE-755
Which versions are affected by CVE-2025-4649?
It affects 1 product.
Products include Centreon Centreon Web.
How do I fix CVE-2025-4649?
No fix has been published for CVE-2025-4649 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-4649 being exploited?
There is no known exploitation of CVE-2025-4649 in the wild and no public exploit code.
Other vulnerabilities in Centreon Centreon Web
Sources
Also known as GHSA-j876-75h4-8xcg.