PT-2025-40516 · Zabbix+3 · Zabbix+3

Y. Kahveci · Published 2025-10-03 · Updated 2025-11-09 · CVE-2025-49641

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description A standard Zabbix user lacking the necessary permissions for the Monitoring -> Problems view can still execute the problem.view.refresh action, allowing them to retrieve a list of active problems. This bypasses intended access controls. The affected action is problem.view.refresh.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2025-13795

ALT-PU-2025-14094

BDU:2025-12726

CVE-2025-49641

Affected Products

Alt Linux

Debian

Red Os

Zabbix

References · 20

• https://support.zabbix.com/browse/ZBX-27063 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49641 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12726 · Security Note
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-49641 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49641 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49641 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49641 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-49641 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-49641 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://twitter.com/CVEnew/status/1974076233127190706 · Twitter Post