Vulnerability · Published Oct 16, 2025 · Assigned by GitHub_M
CVE-2025-61907Icinga 2 API users could access restricted values in filter expressions
High 7.1
In plain English
A high-severity information exposure in icinga2 from Icinga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | icinga2 | no fix listed | DEBIAN-CVE-2025-61907 |
| Debian:13 | icinga2 | 2.14.6-1+deb13u1 | DEBIAN-CVE-2025-61907 |
| Debian:14 | icinga2 | 2.15.1-1 | DEBIAN-CVE-2025-61907 |
| Ubuntu:22.04:LTS | icinga2 | no fix listed | UBUNTU-CVE-2025-61907 |
| Ubuntu:24.04:LTS | icinga2 | no fix listed | UBUNTU-CVE-2025-61907 |
| Ubuntu:25.10 | icinga2 | no fix listed | UBUNTU-CVE-2025-61907 |
| Ubuntu:26.04:LTS | icinga2 | no fix listed | UBUNTU-CVE-2025-61907 |
Affected products (as reported)
Weakness: CWE-200, CWE-204, CWE-749 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N