An unauthenticated authorization bypass in OpenNMS Horizon allows remote attackers to silently disable monitoring and detection capabilities, creating a significant blind spot in network oversight.

This vulnerability stems from a flaw in the Spring Security policy for the /api/v2 REST API, which fails to enforce authorization checks for the PATCH HTTP method. Consequently, an unauthenticated attacker can reach specific configuration endpoints to disable event definitions and SNMP data collection, effectively silencing the monitoring system.

The ability for an attacker to modify monitoring configurations without authentication poses a severe risk to organizational visibility and incident response. By disabling event and alarm generation, an adversary can mask malicious activity or exfiltration, leading to prolonged dwell times and undetected system compromise. With a CVSS score of 8.2, this high-severity flaw requires immediate attention to prevent the degradation of critical security infrastructure.

Immediate Action: Upgrade OpenNMS Horizon to version 36.0.4 or newer to incorporate the necessary security patches.

Proactive Monitoring: Review system access logs for anomalous PATCH requests directed at the /api/v2 REST API and monitor for unexpected changes to event or SNMP configuration settings.

Compensating Controls: Ensure the OpenNMS Horizon instance is restricted to private, trusted network segments and is not directly exposed to the Internet, as recommended by vendor installation guidelines.

Public Exploit Available: No (exploit_available: false)

Given the potential for silent sabotage of security monitoring, this vulnerability should be prioritized for remediation. Administrators must verify their current version and apply the 36.0.4 update immediately to restore proper authorization controls. Organizations should also treat the security of their internal management network as a critical priority to limit the reach of potential attackers.