CVE-2025-27236

User information disclosure via api_jsonrpc.php on method user.get with param search

State: Published
Severity: 2.1 Low
Published: Oct 3, 2025
Updated: Oct 3, 2025
Reserved: Feb 20, 2025

Description

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	Zabbix

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
ZabbixZabbix	6.0.38 through 6.0.40Affectedfrom 6.0.41Not affected 7.0.9 through 7.0.16Affectedfrom 7.0.17Not affected 7.2.3 through 7.2.10Affectedfrom 7.2.11Not affected 7.4.0 to before 7.4.1Affectedfrom 7.4.1Not affected

References

https://support.zabbix.com/browse/ZBX-27060

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.