{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-12523","assignerOrgId":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","state":"PUBLISHED","assignerShortName":"Centreon","dateReserved":"2025-10-30T16:39:26.925Z","datePublished":"2026-10-29T16:29:20.074Z","dateUpdated":"2026-10-30T17:16:11.153Z"},"containers":{"cna":{"providerMetadata":{"orgId":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","shortName":"Centreon","dateUpdated":"2026-10-29T16:29:20.074Z"},"title":"Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure","descriptions":[{"lang":"en","value":"Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user</div>"}]}],"affected":[{"vendor":"Centreon","product":"Centreon","packageName":"https://central.platform/centreon","defaultStatus":"unaffected","versions":[{"status":"affected","version":"24.10","lessThan":"centreon-web-25.10.6","versionType":"custom"},{"status":"affected","version":"24.04","lessThan":"centreon-web-24.10.21","versionType":"custom"},{"status":"affected","version":"25.10.x","lessThan":"centreon-web-24.04.25","versionType":"custom"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-862","description":"CWE-862 Missing Authorization"}]}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"Accessing Functionality Not Properly Constrained by ACLs"}]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"credits":[{"lang":"en","value":"Héctor MORALES","type":"finder"}],"references":[{"url":"https://thewatch.centreon.comundefined","tags":["vendor-advisory"]},{"tags":["release-notes"],"url":"https://github.com/centreon/centreon/releases"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T17:15:53.318787Z","id":"CVE-2025-12523","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-30T17:16:11.153Z"}}]}}