Releasing Icinga DB Web v1.2.2 and Icinga Web v2.12.5

Today we’re announcing the general availability of Icinga DB Web v1.2.2 and Icinga Web 2.12.5.

Icinga DB Web

This is a security release.

It is recommended to upgrade quickly. You can find all issues related to this release on our roadmap.

Access Granted

The new dependency support introduced a few issues with regards to restrictions. One in particular allows users, with access to Icinga Dependency Views, to see hosts and services there weren’t meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host’s or service’s detail view. Please note that this only affects the restrictions filter/hosts and filter/services. filter/objects is not affected and restricts users as it is supposed to.

• Apply filter/hosts and filter/services to dependency queries #1247, GHSA-q2w7-mrx8-5473

Access Denied

If that’s not enough: It’s not only that users were able to gain access which they weren’t granted, but also that previously granted access was denied. Unreachable hosts and services were not accessible due an error. And a change to how removal of multiple comments and downtimes is performed, meant that the removal of single comments and downtimes failed. There’s also a fix for a known issue that caused integrations to fail if they accessed custom variables while a restricted user was logged in.

• Error when displaying an unreachable host because of it’s dependency #1237
• Unable to delete downtimes despite existing permissions #1245
• Object’s customvars property causes error when Role filters objects on custom var value #1162

Icinga Web

You can find all issues related to this release on our roadmap.

PHP 8.4 Support

We’re again a little behind schedule, but now we support PHP 8.4! This means that installations on Ubuntu 25.04 and Fedora 42+ can now install Icinga Web without worrying about PHP related incompatibilities. Icinga packages will be available in the next few days.

Good Things Take Time

There’s only a single (notable) recent issue that is fixed with this release. All the others are a bit older.

• External URLs set up as dashlets are not *embedded* the same as navigation items #5346

But the team sat together a few weeks ago and fixed a bug here and there. And of course, also in Icinga Web!

• Users who are not allowed to change the theme, cannot change the theme mode either #5385
• Improved compatibility with several SSO authentication providers #5000, #5227
• Filtering for older-than events with relative time does not work #5263
• Empty values are NULL in CSV exports #5350