Medium severity · published Oct 16, 2025
CVE-2025-61907
Icinga 2 API users could access restricted values in filter expressions
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
icinga2 · Icinga
>= 2.15.0, < 2.15.1; >= 2.14.0, < 2.14.7; >= 2.4.0, < 2.13.13 · source: vendor
IC
Icinga · Icinga
2.4.0 before 2.13.13; 2.14.0 before 2.14.7; 2.15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61907
Patch
https://github.com/Icinga/icinga2/commit/56255ac7a689b9e198742d2fca6f7459a54c85a3
Patch
https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v
More from icinga2
9.8
CVE-2026-61550
Icinga 2: Improper access control for JSON-RPC update certificate messages
9.8
CVE-2025-48057
Icinga 2 certificate renewal might incorrectly renew an invalid certificate
9.8
CVE-2024-49369
Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections
8.6
CVE-2026-61551
Icinga 2: Stack overflow via deeply nested JSON objects
7.2
CVE-2026-61552
Icinga 2 DSL Injection via Unescaped Import Template Name