CVE-2025-43926: XSS
An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43926?
CVE-2025-43926 is rated as a medium severity vulnerability.
How do I fix CVE-2025-43926?
To fix CVE-2025-43926, update Znuny to version 7.1.7 or later.
What is the impact of exploiting CVE-2025-43926?
Exploiting CVE-2025-43926 can allow attackers to set arbitrary keys in user preferences, potentially leading to unauthorized access or manipulation.
Which versions of Znuny are affected by CVE-2025-43926?
CVE-2025-43926 affects Znuny versions 6.5.14 up to 7.1.6.
What components of Znuny does CVE-2025-43926 involve?
CVE-2025-43926 involves the custom AJAX calls to the AgentPreferences UpdateAJAX subaction.