CVE-2021-32746

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator and users need explicit access permission to use it. Then, by visiting a certain route, it is possible to gain access to arbitrary files readable by the web-server user. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, an administrator may disable the `doc` module or revoke permission to use it from all users.

• CWE-22
• CWE-22

• https://github.com/Icinga/icingaweb2/releases/tag/v2.7.5Release Notes, Third Party Advisory
• https://github.com/Icinga/icingaweb2/releases/tag/v2.8.3Release Notes, Third Party Advisory
• https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0Release Notes, Third Party Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-cmgc-h4cx-3v43Exploit, Third Party Advisory
• https://github.com/Icinga/icingaweb2/releases/tag/v2.7.5Release Notes, Third Party Advisory
• https://github.com/Icinga/icingaweb2/releases/tag/v2.8.3Release Notes, Third Party Advisory
• https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0Release Notes, Third Party Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-cmgc-h4cx-3v43Exploit, Third Party Advisory

Published

Jul 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32740Addressable is an alternative implementation to the URI impl…7.5
• CVE-2021-32741Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32742Vapor is a web framework for Swift. In versions 4.47.1 and p…9.1
• CVE-2021-32743Icinga is a monitoring system which checks the availability …8.8
• CVE-2021-32744Collabora Online is a collaborative online office suite. In …7.5
• CVE-2021-32745Collabora Online is a collaborative online office suite. A r…6.1
• CVE-2021-32747Icinga Web 2 is an open source monitoring web interface, fra…6.5
• CVE-2021-32748Nextcloud Richdocuments in an open source self hosted online…4.3
• CVE-2021-32749fail2ban is a daemon to ban hosts that cause multiple authen…8.1
• CVE-2021-3275Unauthenticated stored cross-site scripting (XSS) exists in …6.1
• CVE-2021-32750MuWire is a file publishing and networking tool that protect…5.7
• CVE-2021-32751Gradle is a build tool with a focus on build automation. In …7.5