CVE-2025-15581

Summary

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.

Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.

Affected Software

Weaknesses

• CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

CVE Program Container

Additional References

• https://lists.debian.org/debian-lts-announce/2026/02/msg00033.html

References

• https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation
• https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326
• https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252

• ←Previous
• Next→