CVE-2026-23925: Zabbix Auth Bypass Vulnerability

CVE-2026-23925 Overview

CVE-2026-23925 is an authorization bypass vulnerability in Zabbix that allows authenticated users with limited privileges to exceed their intended permissions. Specifically, an authenticated Zabbix user with the User role who has template/host write permissions can create objects via the configuration.import API. This vulnerability represents a broken access control flaw (CWE-863) where the API fails to properly enforce role-based restrictions, enabling users to create unauthorized hosts and potentially leading to confidentiality loss.

Under normal circumstances, the User role should not be sufficient to create and edit templates or hosts even when write permissions are granted. However, the configuration.import API endpoint does not properly validate user role restrictions, allowing users to bypass intended access controls.

Critical Impact

Authenticated users can bypass role-based access controls to create unauthorized hosts in Zabbix, potentially compromising confidentiality and enabling unauthorized monitoring of systems.

Affected Products

• Zabbix (specific versions not disclosed in advisory)
• Systems utilizing Zabbix configuration.import API
• Environments with User role accounts that have template/host write permissions

Discovery Timeline

• 2026-03-06 - CVE-2026-23925 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-23925

Vulnerability Analysis

This vulnerability is classified as Incorrect Authorization (CWE-863), a type of broken access control flaw. The core issue stems from the Zabbix configuration.import API failing to properly validate user roles when processing import requests. While the standard user interface correctly enforces role restrictions—preventing User role accounts from creating templates and hosts—the API endpoint bypasses these authorization checks.

The attack requires network access and an authenticated session with a User role account that has been granted template/host write permissions. The vulnerability presents a present attack complexity as the attacker must have specific conditions met, but exploitation does not require user interaction once those conditions exist.

The primary impact is on confidentiality, particularly in downstream systems. By creating unauthorized hosts, an attacker could potentially configure monitoring that exposes sensitive information from systems they should not have visibility into. There is also limited impact on integrity and availability of both the vulnerable system and connected components.

Root Cause

The root cause of CVE-2026-23925 lies in inconsistent authorization enforcement between the Zabbix web interface and its API layer. While the frontend properly checks both user permissions AND user roles before allowing template/host creation operations, the configuration.import API endpoint only validates write permissions without verifying that the user's role permits such operations.

This creates a privilege escalation path where the API trusts permission flags without considering the hierarchical role-based access control model that Zabbix implements. The authorization logic gap allows User role accounts to perform actions that should be restricted to higher-privileged roles.

Attack Vector

The attack vector for CVE-2026-23925 is network-based, requiring the attacker to have:

1. Valid authentication credentials for a Zabbix User role account
2. Template or host write permissions assigned to their account
3. Network access to the Zabbix API endpoint

An attacker with these prerequisites can craft API calls to the configuration.import endpoint to create hosts or templates that their User role should not permit. The imported configuration could include hosts that allow the attacker to gain visibility into systems beyond their authorized scope, effectively bypassing the intended access control boundaries.

The exploitation involves sending properly formatted import requests to the API containing host or template definitions. Since the API does not verify that the requesting user's role permits these operations, the objects are created successfully despite the role restrictions that would block the same operation through the web interface.

Detection Methods for CVE-2026-23925

Indicators of Compromise

• Unexpected hosts or templates appearing in Zabbix that were not created by administrators
• API access logs showing configuration.import calls from User role accounts
• Audit trail entries indicating object creation by users who lack administrative roles
• New monitoring configurations targeting systems outside expected scope

Detection Strategies

• Monitor Zabbix API access logs for configuration.import endpoint calls, correlating the requesting user's role against the operation performed
• Implement alerting for host or template creation events that originate from non-administrative accounts
• Review Zabbix audit logs for discrepancies between user roles and performed actions
• Compare current host/template inventory against known-good baselines to identify unauthorized additions

Monitoring Recommendations

• Enable comprehensive API logging in Zabbix to capture all configuration.import requests with user context
• Configure SIEM rules to alert on API-based configuration changes from User role accounts
• Implement periodic audits of host and template ownership to detect unauthorized creations
• Deploy network monitoring to track API endpoint access patterns from user accounts

How to Mitigate CVE-2026-23925

Immediate Actions Required

• Review and restrict template/host write permissions for User role accounts where not strictly necessary
• Audit existing hosts and templates for any unauthorized entries that may have been created through this vulnerability
• Implement network-level access controls to restrict API access to trusted management systems only
• Monitor the Zabbix Bug Tracking Ticket for patch availability and updates

Patch Information

Organizations should monitor the official Zabbix security advisories and the bug tracking ticket for patch release information. When a patch becomes available, apply it following your organization's change management procedures. Ensure that Zabbix is updated to the patched version as soon as it is released and tested in your environment.

Workarounds

• Remove template/host write permissions from User role accounts unless absolutely required for business operations
• Implement API access restrictions using firewall rules or reverse proxy configurations to limit which users can reach API endpoints
• Use a web application firewall (WAF) to filter requests to the configuration.import endpoint based on user role information
• Consider temporarily disabling the configuration.import API endpoint if it is not required for normal operations

# Example: Restrict API access via nginx reverse proxy
# Add to Zabbix API location block to limit configuration.import access
location /api_jsonrpc.php {
    # Restrict access to administrative IP ranges only
    allow 10.0.0.0/24;  # Admin network
    deny all;
    
    proxy_pass http://zabbix-backend;
    proxy_set_header Host $host;
}