CVE-2023-7322: nagios log_server Incorrect Authorization

Vulnerability summary

CVE-2023-7322 is a high (CVSS 8.7) Incorrect Authorization vulnerability in nagios log_server. EPSS estimates a 1.07% chance of exploitation in the next 30 days, higher than 64.4% of scored vulnerabilities.

Timeline

1. 30-10-2025
   PublishedVulnerability first disclosed.
2. 17-11-2025
   Last modifiedVulnerability information updated.

Description

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.