Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization

Advisories

severity: high
date: October 30, 2025
Affecting: XI < 2024R1.1.2
CVE: CVE-2024-13994
CWE: CWE-862 Missing Authorization
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: Nagios XI Security Disclosures
Nagios XI Changelog
Credit: Kevin De Frene
Description: Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface depending on the target account.