CVE-2025-34273: nagios log_server Incorrect Authorization

Vulnerability summary

CVE-2025-34273 is a high (CVSS 7.1) Incorrect Authorization vulnerability in nagios log_server. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.2% of scored vulnerabilities.

Timeline

1. 30-10-2025
   PublishedVulnerability first disclosed.
2. 17-11-2025
   Last modifiedVulnerability information updated.

Description

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.