Centreon Infra Monitoring Missing Authorization Vulnerability Allowing Information Disclosure

A missing authorization vulnerability has been identified in Centreon Infra Monitoring versions 25.10.0 prior to 25.10.2, 24.10.0 prior to 24.10.15, and 24.04.0 prior to 24.04.19. This vulnerability exists in the Administration parameters API endpoint for modules, where access control lists (ACLs) are not properly enforced. As a result, unauthorized users may gain access to sensitive information such as downtime or acknowledgment configurations.

Impact

Exploitation of this vulnerability could lead to unauthorized access to information regarding system downtime or acknowledgment settings, potentially allowing users to manipulate or misrepresent the status of monitored resources.

Remediation

Users can upgrade to Centreon versions 25.10.4, 24.10.16, or 24.04.20 to address this vulnerability.