CVE-2026-11587: Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0
Published Oct 29, 2026
·Updated
SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database
Event History
Oct 29, 2026
CVE Published
via MITRE·04:38 PM
Data Sourced
via MITRE·04:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated Centreon user who has access to ACL management can exploit it. The attack can be performed remotely and does not require user interaction.
2
What impact could successful exploitation have?
The vulnerability allows the attacker to read and modify the Centreon database. The reported impact includes high confidentiality, integrity, and availability impact.
3
Are systems affected by default?
The available information does not state whether ACL management access is granted in a default Centreon configuration. Exposure depends on whether authenticated users have access to ACL management.