High severity · published Oct 30, 2025
CVE-2023-7322
Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access
8.1
CVSS
1.1%
EPSS
No
On KEV
Description
Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Log Server · Nagios
before 2024R1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-7322
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-7322
Release Notes
https://www.nagios.com/changelog/nagios-log-server-2024r1/
Third Party Advisory
https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access
More from Log Server
9.8
CVE-2025-34277
Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID
9.8
CVE-2025-34274
Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges
9.8
CVE-2025-34271
Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext
8.8
CVE-2025-34298
Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation
8.8
CVE-2025-44823
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call