Medium severity · published Feb 18, 2026
CVE-2025-15581
Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation
4.7
CVSS
0.6%
EPSS
No
On KEV
Description
Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.
Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
orthanc · orthanc-server
through 1.12.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15581
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15581
discourse.orthanc-server.org
https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326
orthanc.uclouvain.be
https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252
projectblack.io
https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation
lists.debian.org
https://lists.debian.org/debian-lts-announce/2026/02/msg00033.html
More from orthanc
9.8
CVE-2026-5442
Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions
9.8
CVE-2026-5443
Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)
9.8
CVE-2025-0896
Orthanc Server Missing Authentication for Critical Function
9.1
CVE-2026-5445
Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)
8.8
CVE-2023-33466
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the…