CVE-2025-15581

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.

CVSS v4.0

4.7 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2026-02-18

Updated

2026-02-28

Proof-of-concept exploits (1)

• https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation

References

• CVE Record
• NVD entry

Related

• CVE-2025-15572
• CVE-2025-15582
• CVE-2025-15571
• CVE-2025-15583
• CVE-2025-15570
• CVE-2025-15585