High severity7.5NVD Advisory· Published Apr 18, 2025· Updated Jun 17, 2026
CVE-2025-28059
CVE-2025-28059
Description
An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke associated API tokens, enabling unauthorized access to restricted functions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:nagios:network_analyzer:2024:r1.0.3:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:nagios:network_analyzer:2024:r1.0.3:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: 2024R1.0.3
Patches
Vulnerability mechanics
References
1- www.nagios.com/changelog/nvdRelease Notes
News mentions
0No linked articles in our index yet.