CVE-2025-49641: Zabbix Authorization Bypass Vulnerability

CVE-2025-49641 Overview

CVE-2025-49641 is a broken access control vulnerability in Zabbix that lets low-privileged users retrieve data they should not see. A regular Zabbix user who has no permission to the Monitoring -> Problems view can still invoke the problem.view.refresh action. The endpoint returns the list of active problems regardless of the caller's view permissions. The flaw is tracked under CWE-863: Incorrect Authorization and is documented in Zabbix Issue Tracker ZBX-27063.

Critical Impact
Authenticated users without Problems view access can enumerate active monitoring problems, leaking infrastructure state and potential outage information to unauthorized accounts.

Affected Products

Zabbix (multiple release branches, see vendor advisory ZBX-27063)
Zabbix frontend problem.view.refresh action handler
Deployments granting authenticated user roles without Problems view permission

Discovery Timeline

2025-10-03 - CVE-2025-49641 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49641

Vulnerability Analysis

The Zabbix web frontend exposes an internal action named problem.view.refresh that returns the current list of active problems. The Problems view itself is gated by role-based permissions. The refresh action, however, does not validate that the calling user holds the required view permission before returning data. Any authenticated user with a session token can trigger the action and receive the same payload as a fully authorized operator.

The result is an information disclosure primitive. Problem records reveal host names, trigger descriptions, severities, and timestamps. Attackers who compromise a low-privileged account can map monitored infrastructure, identify unhealthy systems, and time follow-on activity to coincide with active outages.

Root Cause

The root cause is a missing authorization check in the action handler. The frontend enforces access control on the Problems page controller, but the AJAX refresh endpoint that populates the same data relies on session authentication only. This is a classic parallel-endpoint authorization gap where the UI enforces the policy but a sibling data endpoint does not.

Attack Vector

Exploitation requires a valid Zabbix account with any role assigned and network reachability to the Zabbix frontend. The attacker authenticates, obtains a session cookie, and issues a request to the problem.view.refresh action. The server returns problem data without checking the caller's Problems view permission. No user interaction is required beyond the initial authentication.

Refer to Zabbix Issue Tracker ZBX-27063 for the vendor's technical description and fixed version list.

Detection Methods for CVE-2025-49641

Indicators of Compromise

Requests to the Zabbix frontend containing action=problem.view.refresh originating from user sessions whose role lacks Problems view permission.
Repeated polling of the refresh action from a single low-privileged account at short intervals, consistent with data scraping.
Access patterns where the same account never loads zabbix.php?action=problem.view but frequently calls problem.view.refresh.

Detection Strategies

Correlate Zabbix frontend access logs with the internal user role and permission database to flag refresh calls by users lacking Problems view access.
Enable Zabbix audit logging and alert on problem.view.refresh invocations tied to non-privileged role identifiers.
Deploy a web application firewall rule that inspects authenticated sessions and blocks the refresh action for sessions belonging to restricted roles.

Monitoring Recommendations

Forward Zabbix frontend web server logs and audit logs to a centralized analytics platform for role-aware query correlation.
Baseline the volume of problem.view.refresh calls per user and alert on statistically anomalous spikes.
Review Zabbix user role assignments quarterly to ensure the principle of least privilege is enforced against the Problems view.

How to Mitigate CVE-2025-49641

Immediate Actions Required

Upgrade Zabbix to a version that contains the fix listed in ZBX-27063.
Audit all Zabbix user accounts and remove or disable inactive low-privileged accounts that could be abused for enumeration.
Restrict network access to the Zabbix frontend to trusted management networks using firewall or reverse proxy rules.

Patch Information

Zabbix has published the fix under issue tracker entry ZBX-27063. Administrators should review the advisory for the exact fixed versions across the 6.0, 6.4, 7.0, and 7.2 branches and plan upgrades accordingly. Apply the patched packages from the official Zabbix repositories or container images.

Workarounds

Restrict access to the Zabbix frontend at the reverse proxy layer, allowing only vetted operator networks to reach zabbix.php.
Configure the reverse proxy or WAF to reject requests containing action=problem.view.refresh unless the session belongs to a role with Problems view permission.
Rotate credentials for any low-privileged accounts that have accessed the frontend, and enforce strong authentication policies including multi-factor authentication.

bash

# Example NGINX snippet to block problem.view.refresh at the reverse proxy
# Adjust the allowlist to match your privileged operator source networks
location = /zabbix.php {
    if ($arg_action = "problem.view.refresh") {
        set $block 1;
    }
    if ($remote_addr !~ ^(10\.10\.20\.|10\.10\.21\.)) {
        set $block "${block}1";
    }
    if ($block = 11) {
        return 403;
    }
    proxy_pass http://zabbix_frontend;
}