CVE-2026-64948— Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
Quick assessment
Affected
Pandora FMS Pandora FMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-64948
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:C/RE:L/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Pandora FMS | Pandora FMS | 777 | - |
|
II. Public POCs for CVE-2026-64948
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-64948
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-64948 (1)
Same Patch Batch · Pandora FMS · 2026-10-01 · 8 CVEs total
| CVE-2026-64949 | 8.6 HIGH | Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager |
| CVE-2026-64950 | 8.4 HIGH | Stored Cross-Site Scripting via Directory Name in File Manager Create Directory |
| CVE-2026-64947 | 7.5 HIGH | CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File M |
| CVE-2026-64946 | 7.4 HIGH | CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Man |
| CVE-2026-75786 | 7.2 HIGH | SQL Injection in Grafana Integration Endpoint (query.php) |
| CVE-2026-34189 | 5.9 MEDIUM | CSRF in Event Response Deletion |
| CVE-2026-34190 | 5.9 MEDIUM | CSRF in Alert Command Deletion |
IV. Related Vulnerabilities
Same product: Pandora FMS
-
CVE-2026-75786
SQL Injection in Grafana Integration Endpoint (query.php) -
CVE-2026-64950
Stored Cross-Site Scripting via Directory Name in File Manag -
CVE-2026-64949
Unrestricted File Upload Leading to Remote Code Execution in -
CVE-2026-64947
CSRF Bypass Leading to Remote Code Execution via Unrestricte -
CVE-2026-64946
CSRF Bypass Leading to Stored Cross-Site Scripting via Unres
Same vendor: Pandora FMS
-
CVE-2026-75786
SQL Injection in Grafana Integration Endpoint (query.php) -
CVE-2026-64950
Stored Cross-Site Scripting via Directory Name in File Manag -
CVE-2026-64949
Unrestricted File Upload Leading to Remote Code Execution in -
CVE-2026-64947
CSRF Bypass Leading to Remote Code Execution via Unrestricte -
CVE-2026-64946
CSRF Bypass Leading to Stored Cross-Site Scripting via Unres
Same weakness: CWE-639
-
CVE-2026-103288
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment L -
CVE-2026-103252
n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosu -
CVE-2026-103247
n8n before 1.123.80 Credential Tampering via Duplicate Node -
CVE-2026-103246
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclo -
CVE-2026-103496
CVE-2026-103496
V. Comments for CVE-2026-64948
No comments yet