VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 23, 2019· Updated Aug 5, 2024

CVE-2019-16723

CVE-2019-16723

Description

In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9

Patches

Vulnerability mechanics

Root cause

"The graph_json.php script does not perform authorization checks for graph viewing based on user permissions."

Attack vector

An authenticated user can bypass authorization checks to view any graph by directly accessing the `graph_json.php` script. The attacker modifies the `local_graph_id` parameter in the URL to target a graph they do not have permission to view. The script then returns the graph data, which can be decoded into an image format, revealing the unauthorized graph [ref_id=1].

Affected code

The vulnerability lies within the `graph_json.php` script in Cacti. The researcher noted that while permission checks exist for other actions like tree node creation, there is a lack of specific permission checks for accessing graphs via this script [ref_id=1].

What the fix does

The patch is not provided in the bundle. The advisory indicates that Cacti versions through 1.2.6 are affected. The vendor has not published a specific fix or patch details, but the issue was addressed in later versions.

Preconditions

  • authThe attacker must be an authenticated user.
  • inputThe attacker needs to know or guess the `local_graph_id` of a graph they do not have permission to view.

Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.