CVE-2025-15581

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.

Score

CVSS 4.0 4.7 Medium

Status

Deferred - ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a

Published

2026-02-18

Last modified

2026-02-28

Weaknesses

CWE-287

Affected products

• Orthanc (Orthanc-server)

References

• https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326
• https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252
• https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation
• https://lists.debian.org/debian-lts-announce/2026/02/msg00033.html