Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Icingdaweb2 Director API lets restricted users see hidden objects

CVE-2025-23203 · published 1 year ago
Summary

If you run Icingaweb2’s Director module (versions before 1.10.4 or 1.11.4), a user who can log in but should not see certain hosts or services can still query the REST API and discover or change those hidden items. Upgrade to the patched versions or, if you cannot upgrade, turn off the Director module for all non‑admin users to stop the exposure.

What to do
  • Update debian icingaweb2-module-director to version 1.11.4-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian icingaweb2-module-director All versions
Debian:12 debian icingaweb2-module-director All versions
Debian:13 debian icingaweb2-module-director < 1.11.4-1
Fix: upgrade to 1.11.4-1
Debian:14 debian icingaweb2-module-director < 1.11.4-1
Fix: upgrade to 1.11.4-1
Ubuntu:20.04:LTS canonical icingaweb2-module-director All versions
Original advisory text
Icinga has rest API endpoints accessible to restricted users
Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required (plus api access with regard to the api endpoints). And even though some of these Icinga Director users are restricted from accessing certain objects, are able to retrieve information related to them if their name is known. This makes it possible to change the configuration of these objects by those Icinga Director users restricted from accessing them. This results in further exploitation, data breaches and sensitive information disclosure. Affected endpoints include icingaweb2/director/service, if the host name is left out of the query; icingaweb2/directore/notification; icingaweb2/director/serviceset; and icingaweb2/director/scheduled-downtime. In addition, the endpoint `icingaweb2/director/services?host=filteredHostName` returns a status code 200 even though the services for the host is filtered. This in turn lets the restricted user know that the host `filteredHostName` exists even though the user is restricted from accessing it. This could again result in further exploitation of this information and data breaches. Icinga Director has patches in versions 1.10.4 and 1.11.4. If upgrading is not feasible, disable the director module for the users other than admin role for the time being.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-284Improper Access Control
Timeline
Published26 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-23203 · NVD
DEBIAN-CVE-2025-23203 · OSV
UBUNTU-CVE-2025-23203 · OSV
CVE-2025-23203 · OSV
GHSA-3233-ggc5-m3qg · GHSA
Track software like this
Free during beta