CVE-2025-15581

4.7 mediumEPSS 0.6%

Medium (4.7). EPSS 0.6% chance of exploitation in the next 30 days.

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.

Severity

CVSS 4.0

4.7 medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2026-02-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326
https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252
https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation
https://lists.debian.org/debian-lts-announce/2026/02/msg00033.html

Check your stack JSON