LibreNMS CVE-2026-108715

Exploitation requires an authenticated LibreNMS account that has been granted restricted-user permission on at least one smokeping probe device (PR:L) - it is NOT exploitable by fully unauthenticated attackers. The deployment must have smokeping graphing in use. Given that prerequisite, the attacker simply requests smokeping_in or smokeping_out graphs with arbitrary device IDs; no user interaction, non-default configuration, or special platform is needed. The limiting factor is the required valid restricted account with probe access; impact is confined to read-only disclosure of latency data and device names (no integrity or availability impact), which caps realistic risk to reconnaissance and enumeration.

This is a genuine but low-to-moderate-priority issue, and the available signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and accurately reflects an authenticated information-disclosure flaw: network-reachable, low attack complexity, but requiring low-level authenticated access (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability effect. This aligns with CWE-639 (IDOR / authorization bypass through user-controlled key) and the description, which confirms the impact is bounded to viewing smokeping latency data and enumerating device names - not code execution or data modification. No EPSS score, CISA KEV listing, SSVC decision, or confirmed proof-of-concept is present in the input, so there is no evidence of active exploitation or automatability; absence of these is expected for a low-severity IDOR and should not be read as either safety or elevated risk. Net: a real, valid authorization bug worth patching in the normal cycle, but not an emergency - the privilege prerequisite and information-only impact keep real-world risk modest, and the main consequence is reconnaissance (device-name/topology enumeration) that could aid a broader attack rather than direct compromise.

A restricted LibreNMS user who has legitimately been granted access to a single smokeping probe device logs in and requests a smokeping_in or smokeping_out graph, substituting arbitrary device IDs in the request. Because the authorization check validates the source probe device rather than the rendered target device, the application returns latency graphs and device names for devices the user was never authorized to see, enabling enumeration of the monitored environment. No public exploit code is identified in the provided data, though a technical write-up describing the flaw is referenced.