CVE-2025-13050: Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users
Published Oct 29, 2026
·Updated
Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
Event History
Oct 29, 2026
CVE Published
via MITRE·03:58 PM
Data Sourced
via MITRE·03:58 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker must be authenticated, but only low-level privileges are required. Administrative access is not required.
2
Does exploitation require user interaction or complex conditions?
No user interaction is required, and the attack complexity is rated low. The attack vector is network-based.
3
What security impact is indicated?
The reported impact is limited integrity and availability impact. No confidentiality impact is indicated by the provided CVSS vector.