Cacti CVE-2026-40941

Exploitation requires network reach to the Cacti web application and an existing low-privilege foothold (CVSS PR:L) - i.e., the attacker must already hold or obtain a valid low-level authenticated context to interact with the JWT-handling code path, after which they forge or alter a token whose signature Cacti fails to verify (CWE-347, 'Jwt Attack' tag). No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: the requirement for prior authentication/privilege means it is not exploitable by a fully anonymous remote attacker against a default install per the vector; impact is bounded to integrity (VI:H, VC:N/VA:N), so it enables authorization tampering/forgery rather than direct data exfiltration or denial of service. Affected only on Cacti versions before 1.2.31.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) describes a network-reachable, low-complexity flaw requiring some existing privilege (PR:L) with no user interaction, producing high integrity impact but no confidentiality or availability impact - consistent with token forgery/authorization bypass rather than data theft or service disruption. The 'Information Disclosure' tag partially conflicts with the vector's VC:N (no confidentiality impact), so the precise consequence (integrity/authz bypass vs. information leak) should be confirmed against GHSA-274c-97hj-pv2v. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low-to-moderate today: the prerequisite of an authenticated session (PR:L) and absence of public exploit code reduce urgency relative to the 7.1 base score, but the network vector and JWT-forgery class make it a meaningful patch priority for internet- or LAN-exposed Cacti instances.

A low-privileged authenticated Cacti user (or an attacker who has obtained any valid low-level session) crafts a JWT with manipulated claims that the server accepts because its signature is not properly verified, allowing the attacker to assert elevated or unintended authorization. Because the attack is network-based with low complexity and no user interaction, it can be scripted against any reachable Cacti instance; no public POC was provided in the available data.