Sh0Lt

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.11 **Description** The issue arises when a user account is disabled in Cacti, but the permissions granted to that account are not immediately invalidated. This means that the disabled account may still have access to certain features, such as viewing logs. **Recommendations** For versions prior to 1.2.11, update to version 1.2.11 or later to resolve the issue. As a temporary workaround, consider manually revoking permissions from disabled user accounts until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.11 **Description** The issue allows for a Cross-Site Request Forgery (CSRF) attack, which can be used to change an admin's email address. This can be achieved through the "auth profile.php?action=edit" endpoint. **Recommendations** For versions prior to 1.2.11, update to version 1.2.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the "auth profile.php?action=edit" endpoint to minimize the risk of exploitation.