{"id":"CVE-2026-108715","published":"2026-10-11T13:17:14.577","lastModified":"2026-10-15T20:33:06.527","description":"LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/librenms/librenms","tags":[]},{"url":"https://github.com/librenms/librenms/blob/26.9.1.1/LibreNMS/Util/Graph.php#L190-L198","tags":[]},{"url":"https://github.com/librenms/librenms/blob/26.9.1.1/includes/html/graphs/smokeping/auth.inc.php#L3-L7","tags":[]},{"url":"https://hackmd.io/@haind/librenms-smokeping-graph-src-device-auth-confusion","tags":[]},{"url":"https://www.vulncheck.com/advisories/librenms-through-26.9.1.1-authorization-bypass-via-smokeping-graph-auth-inc-php","tags":[]}],"exploitRefs":[{"url":"https://github.com/librenms/librenms","tags":[]},{"url":"https://github.com/librenms/librenms/blob/26.9.1.1/LibreNMS/Util/Graph.php#L190-L198","tags":[]},{"url":"https://github.com/librenms/librenms/blob/26.9.1.1/includes/html/graphs/smokeping/auth.inc.php#L3-L7","tags":[]}],"hasPoc":true,"ai":null}