CVE-2025-61907

Icinga 2 API users could access restricted values in filter expressions

State: Published
Severity: 7.1 High
Published: Oct 16, 2025
Updated: Oct 16, 2025
Reserved: Oct 3, 2025

Description

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-204 Observable Response Discrepancy
CWE-749 Exposed Dangerous Method or Function

Affected Products

Product	Versions
icinga2Icinga	>= 2.15.0, < 2.15.1Affected >= 2.14.0, < 2.14.7Affected >= 2.4.0, < 2.13.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.