CVE-2026-23919

An authenticated administrator can crash Zabbix server or proxy by creating specially crafted preprocessing/script item JavaScript scripts, leading to denial of service.

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key, leading to potential loss of data integrity.

A Zabbix administrator can read out-of-bounds memory by exploiting a flaw in the HttpRequest logic of script items/preprocessing (JavaScript), leading to potential confidentiality loss.

An authenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the validate.api.exists action, leading to potential denial of service.

The frontend validate.api.exists action can be exploited by authenticated users to extract plaintext user macro values, leading to potential loss of confidentiality.

An unauthenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the popup.testtriggerexpr action, leading to potential denial of service.

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.

The login lockout mechanism in Zabbix API and Frontend has a flaw where several unsuccessful login requests sent simultaneously are not properly counted towards the block counter, potentially allowing more password guesses than intended.

A low-privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Input validation for host and event action scripts in Zabbix uses regex (set by the administrator) but runs in multiline mode. If ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands.