Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-23925
PUBLISHED
More InfoOfficial Page
Assigner-Zabbix
Assigner Org ID-72de3e22-0555-4a0d-ae81-9249e0f0a1e8
View Known Exploited Vulnerability (KEV) details
Published At-06 Mar, 2026 | 08:24
Updated At-09 Mar, 2026 | 20:54
Rejected At-
▼CVE Numbering Authority (CNA)
Unauthorized host creation via configuration.import API by low-privilege user with write permissions

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.

Affected Products
Vendor
ZABBIXZabbix
Product
Zabbix
Repo
https://git.zabbix.com/
Modules
  • API
Default Status
unknown
Versions
Affected
  • From 6.0.0 through 6.0.40 (git)
    • -> unaffectedfrom6.0.41
  • From 7.0.0 through 7.0.17 (git)
    • -> unaffectedfrom7.0.18
  • From 7.4.0 through 7.4.1 (git)
    • -> unaffectedfrom7.4.2
Problem Types
TypeCWE IDDescription
CWECWE-863CWE-863: Incorrect Authorization
Type: CWE
CWE ID: CWE-863
Description: CWE-863: Incorrect Authorization
Metrics
VersionBase scoreBase severityVector
4.05.1MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:N/SA:L
Version: 4.0
Base score: 5.1
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:N/SA:L
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-122CAPEC-122: Privilege Abuse
CAPEC ID: CAPEC-122
Description: CAPEC-122: Privilege Abuse
Solutions

Update the affected components to their respective fixed versions.

Configurations

Low-privilege user invoking configuration.import to perform unauthorized object creation.

Workarounds

Remove template and host write permissions for non-admin users.

Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://support.zabbix.com/browse/ZBX-27567
N/A
Hyperlink: https://support.zabbix.com/browse/ZBX-27567
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found