{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-23T11:06:44.031","vulnerabilities":[{"cve":{"id":"CVE-2026-23925","sourceIdentifier":"security@zabbix.com","published":"2026-03-06T09:15:56.100","lastModified":"2026-06-17T10:22:18.507","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions."},{"lang":"es","value":"Un usuario autenticado de Zabbix (rol de usuario) con permisos de escritura de plantillas/hosts puede crear objetos a través de la API configuration.import. Esto puede llevar a una pérdida de confidencialidad al crear hosts no autorizados. Tenga en cuenta que el rol de usuario normalmente no es suficiente para crear y editar plantillas/hosts, incluso con permisos de escritura."}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unknown","modules":["API"],"repo":"https://git.zabbix.com/","versions":[{"version":"6.0.0","lessThanOrEqual":"6.0.40","versionType":"git","status":"affected","changes":[{"at":"6.0.41","status":"unaffected"}]},{"version":"7.0.0","lessThanOrEqual":"7.0.17","versionType":"git","status":"affected","changes":[{"at":"7.0.18","status":"unaffected"}]},{"version":"7.4.0","lessThanOrEqual":"7.4.1","versionType":"git","status":"affected","changes":[{"at":"7.4.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-09T20:54:37.197085Z","id":"CVE-2026-23925","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.41","matchCriteriaId":"EB51CE02-E39D-402B-A2A4-ABDC678D44F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.18","matchCriteriaId":"9F4CE82D-66AF-4C88-925B-1B5CF1D0F174"},{"vulnerable":true,"criteria":"cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*","versionStartIncluding":"7.4.0","versionEndExcluding":"7.4.2","matchCriteriaId":"02FECC41-6BFA-43DB-8BC0-0317085195AC"}]}]}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-27567","source":"security@zabbix.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]}]}}]}