CVE-2025-53840

Name	CVE-2025-53840
Description	Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts` and `filter/services`. `filter/objects` is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
icingadb-web (PTS)	bookworm	1.0.2-1	fixed
	sid, trixie	1.1.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
icingadb-web	source	experimental	1.2.2-1~exp1
icingadb-web	source	(unstable)	(not affected)

Notes

- icingadb-web <not-affected> (Only affects 1.2.0 and later)
https://github.com/Icinga/icingadb-web/security/advisories/GHSA-q2w7-mrx8-5473
https://github.com/Icinga/icingadb-web/commit/93869319b3696c549ce28c90b261fb9bca2223d7 (v1.2.2)