CVE-2025-61907: icinga 2.15.0; +1 more affected products

Affected technology

icinga · from 2.4.0 (inclusive), before 2.13.13 (exclusive)
icinga

icinga · from 2.14.0 (inclusive), before 2.14.7 (exclusive)
icinga

icinga · 2.15.0
icinga

icinga2 · >= 2.15.0, < 2.15.1, >= 2.14.0, < 2.14.7, >= 2.4.0, < 2.13.13
Icinga

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated API users can learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity and availability impact as none.