Pandora FMS CVE-2026-64948

Requires a valid authenticated Pandora FMS account with low privileges (PR:L) - exploitation is not possible unauthenticated. The deployment must rely on Pandora FMS group-based access control as a security boundary (e.g. multi-tenant or segregated-team monitoring), since the flaw is unauthorized cross-group access to module history; in a single-group/single-tenant install there is no boundary to cross and real-world impact is negligible. Affects Pandora FMS versions 777 onwards. Limiting factors: authentication is mandatory, impact is confidentiality-only (read access to module history, no modification or disruption), and the attacker must reference or enumerate module identifiers outside their authorized group.

This is a CWE-639 insecure-direct-object-reference / missing-authorization flaw in Pandora FMS module data retrieval, allowing an authenticated low-privilege user to read module history belonging to groups they are not authorized for. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and is internally consistent with the description: network-reachable, low attack complexity, requires an existing authenticated account (PR:L), no user interaction, and pure confidentiality impact (VC:H, no integrity or availability effect). The 7.1 is elevated by supplemental/threat modifiers in the vector (AU:Y assumed-breach, R:A recovery-automatic, V:C confirmed value, RE:L low recovery effort, U:Amber) rather than by raw base severity - the base-equivalent impact is a single-dimension information disclosure gated behind authentication. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or at-scale exploitation. SSVC data is absent. Net: this is a credible but moderate, authenticated-only data-confidentiality issue - a legitimate patch priority for multi-tenant Pandora FMS deployments where group-based segregation is a security boundary, but not an emergency unauthenticated RCE-class event.

An attacker with any valid low-privilege Pandora FMS account (e.g. a restricted operator confined to one group) issues a crafted module-data-retrieval request referencing a module ID belonging to another group. Because the server fails to enforce group-level authorization on the history lookup, it returns monitoring history for modules the attacker should not see, exposing operational data across tenant/group boundaries. No public exploit code is identified at time of analysis; exploitation requires only an authenticated session and knowledge or enumeration of out-of-scope module identifiers.