Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-23926

Stored XSS vulnerability in Host navigator widget maintenance tooltip

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Zabbix

Default version status: unknown

  • 7.0.0 to ≤ 7.0.23affected
  • 7.4.0 to ≤ 7.4.7affected

References