Medium severity · published Oct 29, 2026
CVE-2025-12523
Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure
New
6.5
CVSS
–
EPSS
No
On KEV
Description
Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Centreon · Centreon
24.10 before centreon-web-25.10.6; 24.04 before centreon-web-24.10.21; 25.10.x before centreon-web-24.04.25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12523
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12523
github.com
https://github.com/centreon/centreon/releases
thewatch.centreon.comundefined
https://thewatch.centreon.comundefined
More from Centreon
9.8
CVE-2024-32501
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x…
9.8
CVE-2022-3827
centreon Contact Groups Form formContactGroup.php sql injection
9.8
CVE-2021-37558
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via…
9.8
CVE-2019-17647
An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2
9.8
CVE-2018-21024
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request