CVE-2025-15581

Medium CVSS: 4.7

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.

Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.

Vendor

Product

CWE

CWE-287

Yayın Tarihi

2026-02-18 23:16:18

Güncelleme

2026-02-28 18:16:01

Source Identifier

ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a

KEV Date Added

Kategoriler

CWE-287 MEDIUM 2026

Referanslar

https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326 https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252 https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation https://lists.debian.org/debian-lts-announce/2026/02/msg00033.html