CVE-2023-37543: Cacti

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723.

Affected products

• Cacti Cacti: before 1.2.6 (fixed in 1.2.6)

Published 2023-08-10. Last modified 2026-06-17.