Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2025-49641

Insufficient permission check for the problem.view.refresh action

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Zabbix

Default version status: unknown

  • 6.0.0 to ≤ 6.0.40affected
  • 7.0.0 to ≤ 7.0.17affected
  • 7.2.0 to ≤ 7.2.11affected
  • 7.4.0 to ≤ 7.4.1affected

References