CVE-2025-49641 — Insufficient permission check for the problem.view.refresh action

CVE-2025-49641

Insufficient permission check for the problem.view.refresh action PUBLISHED

Description (CNA)

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 6.0.0 through 6.0.40; affected 7.0.0 through 7.0.17; affected 7.2.0 through 7.2.11; affected 7.4.0 through 7.4.1

CWE

CWE-863

References

https://support.zabbix.com/browse/ZBX-27063

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.