CVE-2022-4068: Librenms

Medium severity, CVSS 5.4. EPSS: 35.9% chance of exploitation in the next 30 days.

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.

Affected products

• Librenms Librenms: before 22.10.0 (fixed in 22.10.0)

Published 2022-11-20. Last modified 2026-06-17.