CVE-2025-12523: Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure
Published Oct 29, 2026
·Updated
Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user
Event History
Oct 29, 2026
CVE Published
via MITRE·04:29 PM
Data Sourced
via MITRE·04:29 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated user can exploit it. The listed vector requires low privileges and does not require user interaction.
2
What is the likely impact of successful exploitation?
Successful exploitation can disclose sensitive information through the users configuration endpoint. The provided impact metrics indicate high confidentiality impact, with no integrity or availability impact.
3
Does exploitation require network access or special conditions?
The issue is network-accessible and has low attack complexity. Authentication is required, but no user interaction is required.