Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-23925

Unauthorized host creation via configuration.import API by low-privilege user with write permissions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Zabbix

Default version status: unknown

  • 6.0.0 to ≤ 6.0.40affected
  • 7.0.0 to ≤ 7.0.17affected
  • 7.4.0 to ≤ 7.4.1affected

References