CVE-2026-23925 — Unauthorized host creation via configuration.import API by low-privilege user with write permissions

CVE-2026-23925

Unauthorized host creation via configuration.import API by low-privilege user with write permissions PUBLISHED

Description (CNA)

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 6.0.0 through 6.0.40; affected 7.0.0 through 7.0.17; affected 7.4.0 through 7.4.1

CWE

CWE-863

References

https://support.zabbix.com/browse/ZBX-27567

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.