CVEvulnerability
CVE-2025-15581
4.7 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-02-18
- Last modified
- 2026-06-17
- Assigner
- ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a
- CVSS 4.0 (ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a)
- 4.7 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-287
Description
Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.
Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326 discourse.orthanc-server.org
- https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252 orthanc.uclouvain.be
- https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation projectblack.io
- https://lists.debian.org/debian-lts-announce/2026/02/msg00033.html lists.debian.org