Nagios Log Server CVE-2025-34273

Requires a valid authenticated account with non-administrator (low) privileges on a Nagios Log Server instance running a version prior to 2024R2.0.3; the attacker must reach the global dashboard deletion workflow, where the missing authorization check lets a lower-privileged user perform an action reserved for administrators. Limiting factors: exploitation cannot be performed by an unauthenticated attacker (PR:L), no victim user interaction is needed (UI:N), and impact is confined to removing/altering global dashboards (integrity/availability of the monitoring UI) with no data disclosure or code execution. Risk is highest in multi-user/multi-tenant deployments where non-admin accounts are broadly provisioned.

This is a medium-severity authorization flaw (CVSS 4.0 base 7.1, CWE-863 Incorrect Authorization) whose real-world priority is moderate rather than urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack but one that explicitly requires an authenticated low-privileged account (PR:L) - this is a post-authentication privilege/authorization issue, not an unauthenticated breach. Impact is skewed toward integrity (VI:H) with limited availability impact (VA:L) and no confidentiality impact (VC:N): an attacker cannot read data or take over the host, only destroy/remove global dashboards that affect other users and the monitoring UI. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was supplied in the intelligence, so exploitation-probability signals are absent and cannot be used to raise or lower priority. No active exploitation is indicated. Net assessment: a legitimate issue worth patching, especially in multi-tenant monitoring deployments, but it is a bounded integrity/availability problem gated behind valid credentials rather than a critical remote-takeover bug - the 7.1 score is driven largely by VI:H and should be read in light of the PR:L precondition.

An attacker who already holds a legitimate non-administrator account on a Nagios Log Server instance (for example a read-only monitoring operator) navigates to the global dashboard deletion workflow and issues a delete request that the application fails to authorize against their role. The deletion succeeds, removing dashboards relied upon by administrators and other users and disrupting the shared monitoring UI. No public exploit code was identified in the provided data; exploitation requires valid low-privilege credentials and no user interaction from a victim.