CVE-2025-49641

MEDIUM

5.1

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-10-03

Last Modified2026-06-17

Data SourcesNVD

Vulnerability Description

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

Affected Platforms (CPE)

📦

Zabbix

>= 6.0.0 and < 6.0.41>= 7.0.0 and < 7.0.18>= 7.2.0 and < 7.2.12>= 7.4.0 and < 7.4.2

References & Advisories

🔗 https://support.zabbix.com/browse/ZBX-27063

関連する脆弱性情報

CVE-2026-239258.1

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.impo...

CVE-2025-496436.0

An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially cr...

CVE-2025-496425.9

Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory.

CVE-2025-272326.8

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to p...