CVE-2026-108715 — LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered …
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7