Critical · published January 5, 2026
🚨 A gaping hole in Centreon Infra Monitoring allows unauthorized access to critical functions! 🔥 Think of this vulnerability like a hotel that forgot to lock its VIP lounge. Anyone with a key can stroll in and access exclusive services, leading to chaos behind closed doors! An attacker can exploit this flaw to gain unrestricted access to sensitive functionalities, potentially wreaking havoc on your monitoring environment. This could lead to unauthorized data access, manipulation, or even complete control over critical monitoring operations—absolutely devastating!
Think of this vulnerability like a hotel that forgot to lock its VIP lounge. Anyone with a key can stroll in and access exclusive services, leading to chaos behind closed doors! The vulnerability arises from missing authentication checks in the Awie import module, allowing unauthorized users to access functions without the necessary access control lists (ACLs) in place.
An attacker can exploit this flaw to gain unrestricted access to sensitive functionalities, potentially wreaking havoc on your monitoring environment. This could lead to unauthorized data access, manipulation, or even complete control over critical monitoring operations—absolutely devastating! Immediate action is required: upgrade your Centreon Infra Monitoring to versions 25.10.2, 24.10.3, or 24.04.3 to close this vulnerability. Additionally, review your ACLs and ensure that all critical functions are properly secured to prevent unauthorized access. You've got this! Follow these steps to shore up your defenses and keep your monitoring environment safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| centreon/awie | ≥ 24.04.0, < 24.04.3 | 24.04.3 |
| centreon/awie | ≥ 24.10.0, < 24.10.3 | 24.10.3 |
| centreon/awie | ≥ 25.10.0, < 25.10.2 | 25.10.2 |