Nagios Log Server CVE-2025-34272

Requires an authenticated Nagios Log Server account (PR:L) and the specific triggering state where the user's configured default dashboard has been deleted so the broken fallback path executes. Meaningful information exposure further depends on the deployment's dashboard sharing and access-control configuration - the flaw only exposes data if another accessible/shared dashboard containing information beyond the user's intended scope exists to be loaded as the fallback. Limiting factors: authentication is mandatory, exploitation is conditional (not triggerable against a default/empty state), impact is read-only confidentiality with no integrity or availability effect, and no special protocol or feature toggle is named beyond the dashboard default-fallback behavior.

This is a medium-severity information-exposure flaw (CVSS 4.0 base 5.3) that is a low-to-moderate priority rather than an urgent one, and the signals are broadly consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable issue but one that requires authenticated low-privilege access (PR:L), and impact is confined to low confidentiality only (VC:L, with VI/VA:N), matching the CWE-200 classification and the description's 'information exposure or unexpected privilege exposure' language. There is no CISA KEV listing and no public proof-of-concept referenced, so this is no public exploit identified at time of analysis. The EPSS score is low (0.86%, 57th percentile), which aligns with the picture of an authenticated, low-impact logic flaw rather than a mass-exploited vulnerability. The one area of genuine uncertainty is the real-world impact magnitude: the description hedges heavily ('in some implementations', 'depending on the product's dashboard sharing and access policies'), so whether a given deployment actually exposes sensitive data depends on how dashboards are shared - the flaw is conditional, not deterministic.

An authenticated low-privilege Nagios Log Server user has their configured default dashboard deleted (by an admin or through normal cleanup), and on next login the application fails to fall back to an empty dashboard, instead presenting another existing dashboard. Depending on sharing/access policies, that fallback dashboard may contain log data or views the user was not intended to see, resulting in unintended information exposure. No public exploit code is known, and exploitation is opportunistic/conditional rather than a reliable weaponizable technique.