CVE-2025-53840: Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions filter/hosts and filter/services. filter/objects is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53840?
CVE-2025-53840 has been classified with a moderate severity due to improper access control allowing unauthorized visibility of hosts and services.
How do I fix CVE-2025-53840?
To remediate CVE-2025-53840, upgrade Icinga DB Web to version 1.2.2 or later.
Who is affected by CVE-2025-53840?
CVE-2025-53840 affects users of Icinga DB Web versions 1.2.0 to 1.2.1 who have access to Icinga Dependency Views.
What specific issue does CVE-2025-53840 introduce?
CVE-2025-53840 allows users to view hosts and services in the dependency map that they were not authorized to see.
Is there a workaround for CVE-2025-53840 until I can update?
There are no known workarounds for CVE-2025-53840, so upgrading to the latest version is the recommended action.