CVE-2026-11587EUVD-2026-113220
Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in centreon-web-25.10.15, centreon-web-24.10.28
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Centreon, a network and infrastructure monitoring platform, is affected by this vulnerability. An authenticated user with access to ACL management can exploit an SQL injection flaw to read and modify the Centreon database.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Centreon Web 26.03.0 — Open-source IT monitoring platform (centreon/centreon on GitHub)
From 25.10 · fixed in centreon-web-25.10.15; From 24.10 · fixed in centreon-web-24.10.28