CVE-2026-108715

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.1.2

Description An authorization bypass exists in the file includes/html/graphs/smokeping/auth.inc.php. The system incorrectly validates the source probe device rather than the rendered target device. This allows restricted users with access to a probe device to request smokeping in or smokeping out graphs using arbitrary device ids, enabling them to view latency data and enumerate device names.

Recommendations Update LibreNMS to version 26.9.1.2 or later.