CVE-2025-49641
📋 TL;DR
This CVE describes an authorization bypass vulnerability in Zabbix where regular users without proper permissions can still access the problem viewing functionality. This allows unauthorized users to retrieve lists of active problems, potentially exposing sensitive monitoring data. Organizations running affected Zabbix versions with user accounts are impacted.
💻 Affected Systems
- Zabbix
📦 What is this software?
Zabbix by Zabbix
Zabbix by Zabbix
Zabbix by Zabbix
Zabbix by Zabbix
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could access sensitive monitoring data about system problems, potentially revealing infrastructure details, system health information, or operational issues that should be restricted.
Likely Case
Regular users without proper permissions gain visibility into system problems they shouldn't see, potentially learning about infrastructure issues or gaining operational intelligence.
If Mitigated
With proper access controls and monitoring, the impact is limited to information disclosure of problem lists rather than system compromise.
🎯 Exploit Status
Exploitation requires authenticated access as a regular Zabbix user and involves calling the problem.view.refresh action directly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Zabbix 7.0.4
Vendor Advisory: https://support.zabbix.com/browse/ZBX-27063
Restart Required: Yes
Instructions:
1. Backup your Zabbix configuration and database. 2. Download Zabbix 7.0.4 from official sources. 3. Follow Zabbix upgrade documentation for your specific installation method (package manager, source, etc.). 4. Restart Zabbix services after upgrade.
🔧 Temporary Workarounds
Restrict user permissions
allReview and tighten user permissions to minimize exposure while waiting for patch
Network segmentation
allRestrict access to Zabbix web interface to only authorized users/networks
🧯 If You Can't Patch
- Implement strict access controls and review all user permissions
- Monitor audit logs for unauthorized access to problem viewing functionality
🔍 How to Verify
Check if Vulnerable:
Check if running Zabbix version 7.0.0 through 7.0.3. Test with a regular user account without Monitoring -> Problems permission to see if they can access problem data.Check Version:
zabbix_server --version or check Zabbix web interface under Administration -> General -> AboutVerify Fix Applied:
After upgrading to Zabbix 7.0.4, verify that regular users without proper permissions cannot access problem viewing functionality.📡 Detection & Monitoring
Log Indicators:
- Audit log entries showing regular users accessing problem.view.refresh action
- Unauthorized access attempts to problem viewing functionality
Network Indicators:
- HTTP requests to problem.view.refresh endpoint from unauthorized users
SIEM Query:
source="zabbix" AND (action="problem.view.refresh" OR uri="/zabbix.php?action=problem.view.refresh")