CVE-2025-27236: zabbix 7.4.0; +1 more affected products

Affected technology

zabbix · from 6.0.38 (inclusive), before 6.0.41 (exclusive)
zabbix

zabbix · from 7.0.9 (inclusive), before 7.0.17 (exclusive)
zabbix

zabbix · from 7.2.3 (inclusive), before 7.2.11 (exclusive)
zabbix

zabbix · 7.4.0
zabbix

Zabbix · 6.0.38 through 6.0.40; status changes: 6.0.41 — unaffected, 7.0.9 through 7.0.16; status changes: 7.0.17 — unaffected, 7.2.3 through 7.2.10; status changes: 7.2.11 — unaffected, 7.4.0 to before 7.4.1; status changes: 7.4.1 — unaffected
Zabbix

Component: Frontend

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · Low privileges required · No user interaction required

What an attacker can do

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. Vendor/CNA’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality impact as low; integrity and availability impact as none.