Zabbix 6.0.x < 6.0.48 Multiple Vulnerabilities

high Web App Scanning Plugin ID 115508

Synopsis

Description

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.48, or 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by multiple vulnerabilities :

- A prototype pollution vulnerability in searchParamsToObject() leading to a persistent cross-site scripting (XSS) in Maps, as URL parameter processing did not filter dangerous properties such as __proto__, combined with an unsafe jQuery element creation that traversed the prototype chain. (CVE-2026-23929)

- A hardcoded session key, as in Zabbix 7.4 the cryptographic key used for signing frontend sessions was erroneously written to the database seed. In deployments using both SAML authentication and guest users, the key can be used to forge valid session cookies, potentially leading to unauthorized access. (CVE-2026-23933)

- A denial of service vulnerability, as an unauthenticated user is able to cause disproportionate CPU load on the frontend webserver by sending specifically crafted requests to the popup.testtriggerexpr action. (CVE-2026-23930)

- A denial of service vulnerability, as an authenticated user is able to cause disproportionate CPU load on the frontend webserver by sending specifically crafted requests to the validate.api.exists action. (CVE-2026-23934)

- An information disclosure vulnerability, as the frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values. (CVE-2026-23931)

- An information disclosure vulnerability, as the API host.get action can be exploited by authenticated users to extract a host's PSK key, leading to a potential loss of data integrity. (CVE-2026-23937)

- An out-of-bounds read vulnerability, as a Zabbix administrator is able to read out of bounds memory by utilizing a flaw in the script item/preprocessing (JavaScript) HttpRequest logic. (CVE-2026-23935)

- A race condition in the API and frontend login lockout mechanism, where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended. (CVE-2026-1199)

- An insufficiently protected credentials vulnerability, as the email media OAuth 'Client secret' field cannot be read after saving but can be leaked by a Super Admin setting a malicious 'Token endpoint'. (CVE-2026-23922)

- A denial of service vulnerability, as an authenticated administrator is able to crash the Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts. (CVE-2026-23938)

- An uncontrolled search path element vulnerability, as the Windows agent installer did not verify whether a custom installation directory had secure access permissions, increasing the risk of DLL sideloading. (CVE-2026-59781)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.