CVE-2025-4646 - A high privilege user is able to create and use a valid admin API token in centreon-web

Back Back to CVE browser

HIGH

A high privilege user is able to create and use a valid admin API token in centreon-web

Published May 13, 2025

7.2

HIGH

CVSS 3.1

EPSS 0.43%

Description

Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.

Affected products

Vendor Centreon Product Web Default
unaffected
- Version
  24.04.0
  Status
  affected
  Constraints
  <24.04.10
- Version
  24.10.0
  Status
  affected
  Constraints
  <24.10.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Centreon

Web

unaffected

Version	Status	Constraints
24.04.0	affected	<24.04.10
24.10.0	affected	<24.10.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://github.com/centreon/centreon/releases
release-notesRelease Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55572-centreon-web-high-severity-4460
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://github.com/centreon/centreon/releases		release-notesRelease Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55572-centreon-web-high-severity-4460		vendor-advisoryVendor Advisory