PT-2026-145402

CVE-2026-61637

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 3.1

3.5

Low

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.12.7 Icinga Web 2 versions prior to 2.13.1

Description An attacker can craft a URL that, when visited by an authenticated user, manipulates the backend to redirect the user to an arbitrary location. This issue occurs only if the victim's locale setting in Icinga Web is configured to a value other than en US.

Recommendations Update Icinga Web 2 to version 2.12.7. Update Icinga Web 2 to version 2.13.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Alemmi

Vendors

Affected products

Weakness enumeration

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')

Related identifiers