Improper Access Control on disabling a user.

[sh0lt0]

Describe the bug
Cacti admin console provides a functionality to disable a created user which takes his privileges to perform any action but if a page is auto-refreshed a disabled user can view updated data.

To Reproduce
Steps to reproduce the behavior:

1. Log in with Admin account and navigate to http://192.168.56.106/cacti/user_admin.php?action=user_edit&id=5&tab=realms
2. Give the new user permission to view logs.
3. Login to new user's account and navigate http://192.168.56.106/cacti/clog_user.php
4. From Admin's account disable the created user.

Actual behavior
A disabled user can view the system logs and the logs are even updating after the refresh time.
Expected behavior
A disabled user should not be privileged to view the system logs.

• OS: Ubuntu
• Browser: Firefox
• Version - Cacti 1.2.8

[TheWitness]

Yea, the credentials are cached. Thought there was a mechanism to have the credentials replayed when the admin makes a change to the user account.

[sh0lt0]

I understand that permission propagation takes time but it is assumed the best security practice to implement expiry time to the cache.