CVE-2025-53840

Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts` and `filter/services`. `filter/objects` is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3.

• CWE-200

• https://github.com/Icinga/icingadb-web/releases/tag/v1.2.2Release Notes
• https://github.com/Icinga/icingadb-web/security/advisories/GHSA-q2w7-mrx8-5473Patch, Vendor Advisory

Published

Jul 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53834Caido is a web security auditing toolkit. A reflected cross-…6.3
• CVE-2025-53835XWiki Rendering is a generic rendering system that converts …9
• CVE-2025-53836XWiki Rendering is a generic rendering system that converts …8.8
• CVE-2025-53838LinkAce is a self-hosted archive to collect website links. A…5.4
• CVE-2025-53839DRACOON is a file sharing service, and the DRACOON Branding …4
• CVE-2025-5384A vulnerability was found in JeeWMS up to 20250504. It has b…9.8
• CVE-2025-53841The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore…7.8
• CVE-2025-53842Use of hard-coded credentials issue exists in ZWX-2000CSW2-H…6.8
• CVE-2025-53843A stack-based buffer overflow vulnerability in Fortinet Fort…7.5
• CVE-2025-53844A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.…8.8
• CVE-2025-53845An improper authentication vulnerability [CWE-287] in Fortin…6.5
• CVE-2025-53847A missing authentication for critical function vulnerability…8.8