Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2023-7322Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access

High 8.7

In plain English

A high-severity incorrect authorization in Log Server from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)1.1%top 35.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.

Affected products (as reported)

Vendor	Product	Versions
Nagios	Log Server	0 – before 2024R1

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.nagios.com/changelog/nagios-log-server-2024r1/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access third-party-advisory