CVE-2026-93483
CriticalCVSS 9.5Summary
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. The HTTPBasicAuth modules for the agent and customer interfaces read the username not only from $ENV{REMOTE_USER} but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header.
Risk Assessment
An attacker can log in as any existing user, including administrators, without credentials, gaining full access to confidential data and system controls. This is a severe compromise of the ticketing system.
Recommendation
Upgrade Znuny to a version later than 7.3.6 if available, or disable HTTPBasicAuth modules as the authentication backend. Also remove or block the "Remote-User" header at the web server/proxy level.
Other vulnerabilities in Znuny
See all- CVE-2026-77506Medium
Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.
- CVE-2026-50592Medium
In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (communication log administration view).
- CVE-2026-50591Medium
Cross-Site Scripting (XSS) vulnerability in Znuny LTS before 6.5.21 and Znuny before 7.3.3 via stored user preferences.
Original NVD description (English source)
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS