Centreon CVE-2025-12523

Requires a valid authenticated Centreon account with low privileges (CVSS PR:L); the attacker then abuses the Users Configuration endpoint, which fails to verify that the requested user object belongs to the caller, allowing retrieval of other users' configuration data. Limiting factors: a working authenticated session is mandatory (no anonymous/unauthenticated path), impact is confined to confidentiality disclosure (no write/integrity or availability effect), and only the Users Configuration endpoint is implicated per the description. No special non-default configuration or user interaction is described as required.

This is a moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privileged account (PR:L) and yields only confidentiality impact (C:H, I:N, A:N) - consistent with a Broken Object Level Authorization / Missing Authorization (CWE-862) information-disclosure bug. No EPSS probability, CISA KEV listing, or SSVC automatability/technical-impact values were supplied in the input, so exploitation likelihood cannot be quantified from these sources; the only priority signal is the vuln.today Decision label 'this_month', which aligns with patch-this-cycle urgency rather than act_now/emergency. No public exploit or PoC reference is present in the input (the GitHub releases link is a vendor source page, not exploit code). Net: a genuine but bounded authenticated-user data-exposure risk - worth scheduled remediation, not a drop-everything event. Note a data-quality caveat: one reference URL is malformed ('https://thewatch.centreon.comundefined'), limiting independent verification of advisory details.

An attacker who already holds a valid low-privileged Centreon account logs into the web interface and sends requests to the Users Configuration endpoint, substituting object identifiers belonging to other users. Because the endpoint fails to enforce per-object authorization, it returns configuration data the attacker is not entitled to see, exposing other users' sensitive details. No public exploit code is identified in the provided data, and a valid authenticated session is required.