CVE-2026-93483: Znuny Znuny vulnerability
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTEUSER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTPREMOTEUSER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Znuny installations through 7.3.6 are exposed when HTTPBasicAuth is configured as the authentication backend for the agent interface, customer interface, or both. The affected modules are Kernel::System::Auth::HTTPBasicAuth and Kernel::System::CustomerAuth::HTTPBasicAuth.
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to send an HTTP request to an affected login interface and supply a forged Remote-User request header. No password or other credentials are required, but the impersonated username must correspond to an existing user.
What access can exploitation provide?
An attacker can impersonate any existing user, including an administrator. This can provide access to confidential data and sensitive system controls available to the impersonated account.
What can be done if patching is not immediately possible?
Remove or disable HTTPBasicAuth as the authentication backend for the affected agent and customer interfaces until a fix can be applied. The vulnerable behavior is specifically the fallback that accepts the attacker-controlled HTTP_REMOTE_USER value.