LibreNMS before 26.9.0 contains an SQL injection flaw that allows unprivileged users to supply an array‑valued notification_id parameter to notifications.inc.php, enabling arbitrary SQL commands to be executed against the database. The injected statements can read across tables, leading to retrieval of users.password hashes, and the query results are written into the notifications_attribs table, where they can be viewed through the web interface. This flaw directly compromises confidentiality of stored credentials and could be leveraged for broader lateral movement within the affected environment.

The vulnerability affects the LibreNMS application for any deployments running a version earlier than 26.9.0. This includes all instances where notifications.inc.php is served by the LibreNMS web front end. The originating vendor is LibreNMS, and affected CPEs list only the generic librenms product.

The CVSS score of 7.1 denotes a medium severity with significant impact. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited known exploitation. Nonetheless, attackers can target any unprivileged user via the public web controller, injected payloads may be submitted through the notification_id field, and the persistence of the results increases the attack surface. An attacker who gains access simply needs to craft a request with an array value and can retrieve password hashes without requiring additional privileges.