What’s Vulnerable › Vulnerabilities
CVE-2026-23925: Unauthorized host creation via configuration.import API by low-privilege user with write permissions
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-06 · updated 2026-06-17
- Weakness: CWE-863
Description
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.
Affected products
- Zabbix: from 6.0.0 before 6.0.41; from 7.0.0 before 7.0.18; from 7.4.0 before 7.4.2 — fixed in 6.0.41, 7.0.18, 7.4.2
How to fix
Upgrade to a fixed version: Zabbix 6.0.41, 7.0.18, 7.4.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-23925 or the next vulnerability affects your stack