CVE-2025-15581: Orthanc Privilege Escalation Vulnerability

CVE-2025-15581 Overview

CVE-2025-15581 is an authorization bypass vulnerability affecting Orthanc medical imaging server versions prior to 1.12.10. The vulnerability stems from an authorization logic flaw in the application's HTTP Basic Authentication implementation, which can be exploited to achieve privilege escalation and potentially gain full administrative access to the medical imaging system.

Critical Impact

Successful exploitation could result in privilege escalation, potentially allowing attackers to gain full administrative access to Orthanc servers containing sensitive medical imaging data.

Affected Products

• Orthanc versions before 1.12.10

Discovery Timeline

• 2026-02-18 - CVE-2025-15581 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-15581

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication), indicating a fundamental flaw in how the Orthanc server validates and enforces authentication credentials. The authorization logic within the HTTP Basic Authentication mechanism fails to properly verify user privileges, creating an opportunity for authenticated low-privilege users to escalate their access rights.

Orthanc is a lightweight, RESTful DICOM server commonly deployed in healthcare environments to store and manage medical imaging data. The security implications of this vulnerability are significant given that medical imaging systems typically contain protected health information (PHI) subject to regulatory requirements such as HIPAA.

Root Cause

The root cause lies in the flawed authorization logic within Orthanc's HTTP Basic Authentication implementation. The server fails to properly validate user privilege levels after initial authentication, allowing authenticated users to perform actions beyond their assigned permissions. This represents a classic authentication bypass where credential verification succeeds but subsequent authorization checks are insufficient or improperly implemented.

Attack Vector

The attack leverages the network-accessible HTTP interface exposed by Orthanc servers. An attacker with valid low-privilege credentials can exploit the authorization flaw to impersonate higher-privileged users or directly access administrative functions. The attack requires:

1. Network access to the target Orthanc server
2. Valid authentication credentials (even low-privilege)
3. User interaction may be required in certain exploitation scenarios

The vulnerability enables user impersonation attacks where an authenticated user can bypass authorization controls to access resources or perform actions reserved for administrators. Detailed exploitation analysis is available in the Project Black technical writeup.

Detection Methods for CVE-2025-15581

Indicators of Compromise

• Unusual authentication patterns showing low-privilege users accessing administrative endpoints
• Audit log entries indicating authorization inconsistencies or privilege escalation attempts
• HTTP request anomalies in Basic Authentication headers suggesting impersonation attempts

Detection Strategies

• Monitor Orthanc access logs for requests to administrative endpoints from non-administrative user accounts
• Implement alerting on failed authorization attempts followed by successful access to privileged resources
• Deploy network intrusion detection rules to identify anomalous authentication patterns to Orthanc servers

Monitoring Recommendations

• Enable verbose logging in Orthanc to capture authentication and authorization events
• Establish baseline user activity patterns and alert on deviations
• Regularly audit user privilege assignments and access patterns in Orthanc deployments

How to Mitigate CVE-2025-15581

Immediate Actions Required

• Upgrade Orthanc to version 1.12.10 or later immediately
• Review access logs for evidence of exploitation attempts
• Audit user accounts and privileges to identify any unauthorized changes
• Implement network segmentation to limit exposure of Orthanc servers

Patch Information

The vulnerability has been addressed in Orthanc version 1.12.10. Organizations should upgrade to this version or later to remediate the authorization bypass flaw. Release notes and upgrade instructions are available in the Orthanc Server Release Note. Additional technical details about the fix can be found in Orthanc Bug Report #252.

Workarounds

• Restrict network access to Orthanc servers using firewall rules to limit exposure to trusted networks only
• Implement additional authentication layers such as VPN or reverse proxy with strong authentication in front of Orthanc deployments
• Disable or remove unnecessary user accounts to minimize the attack surface
• Consider temporarily disabling remote access to Orthanc until the patch can be applied