High severity · published May 13, 2025
CVE-2025-4646
A high privilege user is able to create and use a valid admin API token in centreon-web
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
web · Centreon
24.04.0 before 24.04.10; 24.10.0 before 24.10.4 · source: vendor
CW
Centreon Web · Centreon
24.04.0 before 24.04.10; 24.10.0 before 24.10.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4646
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4646
Release Notes
https://github.com/centreon/centreon/releases
Vendor Advisory
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55572-centreon-web-high-severity-4460
More from web
9.8
CVE-2026-2750
Command Injection via CLAPI generatetraps
8.8
CVE-2025-6791
Second order SQL injection available to user with low privilege
7.2
CVE-2025-4650
User with high privileges is able to introduce a SQLi using the Meta Service indicator page
5.9
CVE-2025-4648
A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.
4.9
CVE-2025-4649
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.