LibreNMS CVE-2026-109353

Requires an authenticated LibreNMS account at any privilege level (the description explicitly states 'unprivileged users'), matching PR:L - there is no anonymous/unauthenticated path. The specific trigger is supplying the notification_id parameter to notifications.inc.php as an array value instead of a scalar, which breaks the query construction and enables SQL injection; a normal scalar value does not trigger it. No special non-default configuration, platform, or user interaction is needed - any default LibreNMS instance before 26.9.0 with a reachable login is exploitable. The limiting factors are the account requirement and the need to interact with the notifications subsystem; the affected version ceiling (<26.9.0) bounds exposure.

This is a credible, actionable priority rather than a CVSS-inflated non-issue, though not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-privilege authentication and no user interaction - i.e., any ordinary logged-in LibreNMS user can trigger it. The 7.1 (High) score is driven by VC:H: the flaw reads users.password hashes across tables, a high-confidentiality impact that can seed credential-cracking and privilege escalation. VI:L reflects that attacker output is persisted into notifications_attribs rows. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is currently potential, not observed. The main counterbalance to the network vector is PR:L: exploitation requires a valid (if unprivileged) account, which limits purely external anonymous attackers and shifts this toward insider or post-foothold scenarios. No signals conflict with the vector; the chief unknown is simply the absence of exploitation-probability telemetry (EPSS) in the input.

An attacker holding any low-privileged LibreNMS account sends a crafted request to notifications.inc.php supplying notification_id as an array rather than a scalar, injecting SQL that pulls password hashes from the users table. The injected query result is written into notifications_attribs and then read back through the normal web interface, letting the attacker harvest administrator hashes for offline cracking. No public exploit is identified at time of analysis, but the low attack complexity and no-interaction requirement make weaponization straightforward for an authenticated actor.