Pandora Fms CVE-2026-30811

Authenticated user with any login credentials to Pandora FMS versions 777-800 can access the configuration endpoint remotely without authorization checks. No victim interaction required. Affects default installations where authentication is enabled.

This vulnerability presents elevated real-world risk despite requiring initial authentication. The CVSS 8.4 score accurately reflects severity given the high confidentiality impact and potential for privilege escalation. Attack complexity is low (AC:L) with no additional timing constraints (AT:N), making exploitation straightforward for any authenticated user. The PR:L requirement means attackers need only basic user credentials, which could be obtained through phishing, credential stuffing, or insider access. The high subsequent availability impact (SA:H) suggests exposed configuration data could enable destructive follow-on attacks. Without EPSS data available, exploitation probability cannot be quantified, but the technical accessibility and value of configuration data in monitoring systems make this an attractive target. No CISA KEV listing or public POC identified, indicating exploitation has not been publicly confirmed. However, the simplicity of authorization bypass attacks and the critical role Pandora FMS plays in network visibility creates significant risk in enterprise environments where monitoring systems often have privileged access across infrastructure. Priority should be elevated for organizations using Pandora FMS in production, especially multi-user deployments.

An attacker with basic user credentials to a Pandora FMS instance directly accesses configuration endpoints without proper authorization checks. The attacker retrieves sensitive configuration data including database connection strings, SNMP community strings, API credentials for integrated systems, and internal network architecture details. Using the exposed credentials, the attacker pivots to backend databases or monitored systems, escalating privileges across the infrastructure. The high subsequent availability impact suggests the attacker could also modify monitoring configurations to disable alerting before launching destructive attacks.