PT-2026-20548 · Owi Ingenie · Orthanc

Published 2025-01-01 · Updated 2026-02-28 · CVE-2025-15581

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Orthanc versions prior to 1.12.10

Description An authorisation logic flaw exists in the HTTP Basic Authentication implementation of Orthanc. Successful exploitation could lead to privilege escalation, potentially granting full administrative access.

Recommendations Update to version 1.12.10 or later.

Fix

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-15581

Affected Products

Orthanc

References · 16

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-15581 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-15581 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-15581 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-15581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15581 · Security Note
• https://ubuntu.com/security/CVE-2025-15581 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2026266446498537838 · Twitter Post
• https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation · Note
• https://t.me/cveNotify/152449 · Telegram Post
• https://t.me/cveNotify/152452 · Telegram Post
• https://t.me/cveNotify/153644 · Telegram Post
• https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326 · Note
• https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252 · Note
• https://t.me/CVEtracker/45030 · Telegram Post
• https://twitter.com/CVEnew/status/2026265078144651284 · Twitter Post