Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2025-34298Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation

High 8.7

In plain English

A high-severity security flaw in Log Server from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.

Affected products (as reported)

Vendor	Product	Versions
Nagios	Log Server	0 – before 2024R1.3.2

Weakness: CWE-281 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.nagios.com/changelog/nagios-log-server-2024r1/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-log-server-set-email-privilege-escalation third-party-advisory