The vulnerability is a classic SQL injection flaw (CWE-89) that arises when the Centreon ACL (Resources & Actions) module accepts array keys without proper validation. An authenticated user with permission to manage ACLs can inject malicious SQL through the array key field, enabling read and modification of the underlying database. This allows bypassing normal data access controls and potentially leaking or altering critical monitoring information.

The flaw is known to affect the Centreon platform, specifically version 26.03.0. It is unlikely that earlier releases are impacted, and the documented advisory does not list any other versions as vulnerable.

With a CVSS score of 7.2 the vulnerability is considered high severity. The EPSS score is not available, suggesting no publicly known exploit activity is tracked, and it is not present in the CISA KEV catalog. The attack vector would need the attacker to be authenticated and possess ACL management authorization, which limits the scope to users with at least that level of privilege.