PT-2025-40513 · Zabbix+2 · Zabbix+2

Exod

+1

·

Published

2025-10-03

·

Updated

2025-11-05

·

CVE-2025-27236

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)
Description A regular user can search for other users within their user group through the Zabbix API and access fields they are not authorized to view. This enables the extraction of data from fields the user normally lacks access to. The issue involves the ability to query user information via the API, potentially revealing sensitive details.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863CWE-200

Related Identifiers

BDU:2025-12725
BDU:2025-12726
BDU:2025-13818
CVE-2025-27236

Affected Products

Debian
Red Os
Zabbix