CVE-2025-27236: Zabbix Information Disclosure Vulnerability

CVE-2025-27236 Overview

CVE-2025-27236 is an authorization flaw in Zabbix that allows an authenticated regular user to enumerate information about other users in their user group via the Zabbix API. By supplying selection parameters referencing restricted fields, the user can infer values from fields they are not authorized to view. The issue is tracked as an improper authorization weakness [CWE-863] and affects the Zabbix monitoring platform. Exploitation requires valid low-privilege credentials and adjacent network access to the API endpoint.

Critical Impact
Authenticated low-privilege users can data-mine restricted user field values through Zabbix API search queries, exposing information they should not be able to access.

Affected Products

Zabbix (multiple versions per vendor advisory)
Zabbix 7.4.0
Zabbix API user.get interface

Discovery Timeline

2025-10-03 - CVE-2025-27236 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27236

Vulnerability Analysis

The vulnerability resides in the Zabbix API user query interface. When a regular user issues a user.get request, the backend evaluates search and filter parameters before applying the field-level authorization checks that govern which attributes the requester can view. This ordering allows a low-privilege user to specify constraints against fields they cannot read directly.

By iteratively adjusting the search value and observing whether the API returns matching users in the same user group, an attacker can infer the actual value of a restricted field character by character. The flaw is a classic authorization boundary error [CWE-863] where the query engine trusts caller-supplied selectors that reference attributes outside the caller's visibility scope. Impact is limited to confidentiality of user-object fields within the attacker's user group. Integrity and availability are not affected. The Zabbix issue tracker entry ZBX-27060 documents the vendor's remediation.

Root Cause

The Zabbix API applies field-level access control after processing search predicates rather than before. Restricted fields remain usable as search filters, producing observable differences in API responses that reveal protected data.

Attack Vector

An attacker needs an authenticated account with regular user privileges on the Zabbix instance and network reachability to the API. The attacker submits repeated user.get calls with search parameters targeting restricted fields and infers values from response membership. No user interaction is required.

No public proof-of-concept exploit or CISA KEV listing is associated with this CVE. Technical exploitation details are described in the vendor advisory rather than through synthetic code.

Detection Methods for CVE-2025-27236

Indicators of Compromise

Repeated user.get API calls from a single authenticated regular user targeting the same user group
Search parameter values that iterate through character sets or substrings, consistent with inference attacks
Unusual volume of authenticated API traffic from accounts that do not typically use the API

Detection Strategies

Enable Zabbix API audit logging and review user.get requests that include search filters referencing sensitive fields
Correlate API request patterns per user account to identify enumeration behavior against user objects
Alert on regular (non-admin) accounts issuing high-frequency user-lookup queries within short time windows

Monitoring Recommendations

Forward Zabbix frontend and API audit logs to a centralized SIEM for retention and analytics
Baseline typical API usage per role and flag deviations from that baseline
Track failed and successful authentication events tied to Zabbix API tokens

How to Mitigate CVE-2025-27236

Immediate Actions Required

Apply the Zabbix vendor update referenced in ZBX-27060 once available for your release branch
Audit existing Zabbix user accounts and remove unused or over-privileged regular users
Rotate Zabbix API tokens issued to accounts that may have queried the user.get endpoint

Patch Information

Zabbix has tracked and addressed this authorization issue under ZBX-27060. Administrators should follow the vendor advisory for the patched build corresponding to their Zabbix version, including the 7.4.0 branch identified in the affected configuration.

Workarounds

Restrict network access to the Zabbix API to trusted management subnets using firewall or reverse-proxy rules
Reduce membership overlap in user groups so regular users share groups with as few sensitive accounts as possible
Disable or limit API access for accounts that do not require programmatic use of Zabbix

bash

# Example: restrict Zabbix API access at the reverse proxy (nginx)
location /api_jsonrpc.php {
    allow 10.0.0.0/24;   # trusted management subnet
    deny all;
    proxy_pass http://zabbix_backend;
}