CVE-2025-12523 in Centreon
Summary
by MITRE • 10/29/2026
Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability described constitutes a Broken Object Level Authorization (BOLA) flaw within the application's users configuration endpoint, representing a critical failure in access control mechanisms that governs how resources are accessed by authenticated entities. This specific type of security weakness is formally categorized under CWE-639, which addresses authorization issues related to indirect reference manipulation or insufficient verification of object-level permissions. In this scenario, an attacker who has successfully authenticated to the application can manipulate parameters within API requests targeting user configuration data to access information belonging to other users. The core technical flaw lies in the server-side logic failing to validate whether the requesting user possesses the necessary privileges to view or modify the specific resource identified by the provided identifier, such as a user ID or account number. Instead of enforcing strict ownership checks or verifying that the authenticated session corresponds directly to the requested object, the application relies on predictable identifiers or fails to cross-reference the request context with the user's assigned roles and permissions.
From an operational perspective, this vulnerability enables unauthorized information disclosure, allowing attackers to extract sensitive personal data, account details, authentication tokens, or other confidential attributes associated with any user in the system. The impact is severe because it bypasses standard authentication barriers, leveraging valid credentials to escalate privileges effectively from a single-user context to a global view of all users' private configurations. This aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts, where adversaries use legitimate credentials to access resources they should not have permission to see. The exploitation typically involves simple parameter tampering, such as incrementing or decrementing numeric IDs in the URL path or request body, a method that is both low-effort and highly effective against applications lacking robust input validation and authorization checks at the object level.
The presence of this vulnerability indicates a fundamental gap in the implementation of Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC) models within the application's backend services. Developers may have assumed that because the user is authenticated, they are authorized to access any resource associated with their account type, neglecting the distinction between vertical privilege escalation and horizontal data isolation. This oversight allows for mass data exfiltration if an attacker iterates through a range of identifiers, potentially violating regulatory compliance standards such as GDPR or HIPAA due to the exposure of personally identifiable information without consent. To mitigate this risk, developers must implement strict object-level authorization checks on every endpoint that handles sensitive resources. This involves verifying that the resource identifier in the request matches the identity of the authenticated user or falls within a scope explicitly permitted by their role. Additionally, implementing indirect reference maps where internal identifiers are replaced with opaque, random tokens can prevent enumeration attacks based on sequential ID guessing. Regular security testing using dynamic application security scanning tools and manual penetration tests focused on access control logic is essential to identify and remediate such flaws before they can be exploited in production environments.