CVE-2026-23925

Unauthorized host creation via configuration.import API by low-privilege user with write permissions

State: Published
Severity: 5.1 Medium
Published: Mar 6, 2026
Updated: Mar 9, 2026
Reserved: Jan 19, 2026

Description

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:N/SA:L	Zabbix

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
ZabbixZabbix	6.0.0 through 6.0.40Affectedfrom 6.0.41Not affected 7.0.0 through 7.0.17Affectedfrom 7.0.18Not affected 7.4.0 through 7.4.1Affectedfrom 7.4.2Not affected

References

https://support.zabbix.com/browse/ZBX-27567

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.