---
id: CVE-2025-13050
title: >-
  Broken Function Level Authorization — `postcommand.php` allows execution of
  poller post-restart commands by non-admin users
summary: >-
  Broken Function Level Authorization allows execution of poller post-restart
  commands by authenticated user
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-863
vendor: Centreon
product: 'https://central.platform/centreon'
affected:
  - 'https://central.platform/centreon >= 25.10 < centreon-web-25.10.9'
  - 'https://central.platform/centreon >= 24.10 < centreon-web-24.10.21'
  - 'https://central.platform/centreon >= 24.04 < centreon-web-24.04.25'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:23:12.106820Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:23:25.626Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-13050'
references:
  - url: 'https://thewatch.centreon.comundefined'
  - url: 'https://github.com/centreon/centreon/releases'
tags:
  - cve.org
epss: 0.00257
epssPercentile: 0.17451
ingestedAt: '2026-11-05T16:24:31.282Z'
---

## Overview

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user

## Affected

- `https://central.platform/centreon >= 25.10 < centreon-web-25.10.9`
- `https://central.platform/centreon >= 24.10 < centreon-web-24.10.21`
- `https://central.platform/centreon >= 24.04 < centreon-web-24.04.25`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.