CVE-2026-23925: Unauthorized host creation via configuration.import API by low-privilege user with write permissions
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23925?
CVE-2026-23925 is considered a high severity vulnerability due to unauthorized host creation by low-privilege users.
How do I fix CVE-2026-23925?
To fix CVE-2026-23925, restrict template/host write permissions for low-privilege Zabbix users to prevent unauthorized access.
Who is affected by CVE-2026-23925?
CVE-2026-23925 affects Zabbix installations where low-privilege users have been granted template/host write permissions.
What can be exploited in CVE-2026-23925?
CVE-2026-23925 can be exploited to create unauthorized objects via the configuration.import API, leading to potential confidentiality breaches.
Is there a workaround for CVE-2026-23925?
A temporary workaround for CVE-2026-23925 is to review and adjust user roles and permissions to limit access to the configuration.import API.