← CVE Intelligence

CVE-2025-27236

User information disclosure via api_jsonrpc.php on method user.get with param search PUBLISHED

Description (CNA)

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.

Affected (CNA)

Vendor / productVersions
Zabbix / Zabbixaffected 6.0.38 through 6.0.40; affected 7.0.9 through 7.0.16; affected 7.2.3 through 7.2.10; affected 7.4.0 before 7.4.1

CWE

CWE-863

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.