LibreNMS has Broken Access control on Graphs Feature

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

• CVE-2023-48294: 0.69% estimated exploitation activity in the next 30 days; percentile 53.02 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary This vulnerability occurs when application is not checking access of each type of users as per their role and it autorizing the users to access any feature. When user access his Device dashboard in librenms, one request is going to graph.php to access image of graphs generated on the particular Device. This request can be accessed by lower privileged users as well and they can enumerate devices on librenms with their id or hostname. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. PoC 1. Login with Lower privilege user 2. Go to /graph.php?width=150&height=45&device=1&type=devicepingperf&from=1699022192&legend=no&bg=FFFFFF00&popuptitle=ICMP+Response 3. If its showing image with "devicepingperf" which confirms that there is device with id 1 4. Now you can change device parameter in above URL with hostname to check if that Hostname/IP exist or not like…

Published by the source

17 Nov 2023, 21:51 UTC

Last modified by the source

20 Nov 2023, 22:06 UTC

Source last checked

26 Oct 2026, 14:11 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-fpq5-4vwm-78x4

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2023-48294

Advisory: LibreNMS has Broken Access control on Graphs Feature
IDs: CVE-2023-48294, GHSA-fpq5-4vwm-78x4
Record: https://patchnext.com/advisories/cve-2023-48294 (revision 1, source checked 26 Oct 2026, 14:11 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: librenms/librenms 23.11.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist librenms/librenms: affected < 23.11.0; fixed in 23.11.0

## Suggested inspection (read-only)
- Packagist librenms/librenms: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on librenms/librenms.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-fpq5-4vwm-78x4 (GitHub-reviewed advisory GHSA-fpq5-4vwm-78x4 lists affected ranges: Packagist librenms/librenms >=0 <23.11.0)

Commands are suggestions: review each one before running it.