OpenNMS Horizon contains a missing authorization vulnerability (CWE-862) in its /api/v2 REST API where PATCH HTTP methods lack authorization enforcement. This affects endpoints related to event configuration and SNMP data collection, allowing unauthenticated attackers who can reach the web UI to disable critical monitoring functions. The changes persist and reload into the running system, causing silent degradation of monitoring and detection capabilities. The vulnerability affects versions >=36.0.0 and <36.0.4. The vendor has addressed this issue in version 36.0.4. The product is designed for private network use and should not be exposed to the Internet.

An unauthenticated attacker with access to the web UI can disable event definitions and SNMP data collection, which suppresses event and alarm generation and stops metric collection. This results in silent degradation of monitoring and detection capabilities, potentially allowing malicious activity or system failures to go unnoticed. The integrity of monitoring data is impacted, but confidentiality is not affected. Availability impact is low as the system continues running but with reduced monitoring functionality.

Upgrade to OpenNMS Horizon version 36.0.4 or newer, where the missing authorization on PATCH methods has been fixed. Additionally, ensure that Horizon installations are deployed within private networks and are not directly accessible from the Internet, as recommended by the vendor. Patch status is confirmed by the vendor advisory specifying the fix in version 36.0.4.