CVE-2025-4649: ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-13 · updated 2026-06-17
Weakness: CWE-755

Description

Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26.

Affected products

Centreon: from 23.04.24 before 23.04.26; from 23.10.19 before 23.10.21; 24.04.9, 24.10.3 — fixed in 23.04.26, 23.10.21

How to fix

Upgrade to a fixed version: Centreon 23.04.26, 23.10.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-4649 or the next vulnerability affects your stack