CVE-2026-23925

Vendor solution

Update the affected components to their respective fixed versions.

Red Hat statement

This MODERATE impact vulnerability in Zabbix allows an authenticated user with template/host write permissions to create unauthorized hosts via the configuration.import API. This bypasses the normal restrictions for the 'User' role, which typically prevents such users from creating or editing templates and hosts.

Red Hat mitigation

To mitigate this issue, enforce strict role-based access control within Zabbix. Ensure that low-privilege users, especially those with the 'User' role, are not granted template or host write permissions that could be exploited via the `configuration.import` API for unauthorized host creation. Regularly audit user permissions to adhere to the principle of least privilege.