CVE-2026-23926

An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.

References

https://support.zabbix.com/browse/ZBX-27758

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type

GIT

Repo

https://github.com/zabbix/zabbix

Events

Introduced

49955f1fb5c9168a8a24b053f7ade6b3d903143c

Fixed

36bdd34b378e8731c7c825df38c364e00a76e6a5

Introduced

372a4e93c48ecd25aa666949a055a02369031861

Fixed

6b0f6b25da00d2c2a0dc2035ba2285aa51c85865

Database specific

Show details

{
    "cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.24"
        },
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.8"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

7.*

7.0.0

7.0.1

7.0.10

7.0.10rc1

7.0.11

7.0.11rc1

7.0.11rc2

7.0.12

7.0.12rc1

7.0.13

7.0.13rc1

7.0.14

7.0.14rc1

7.0.15

7.0.16

7.0.17

7.0.17rc1

7.0.17rc2

7.0.18

7.0.18rc1

7.0.18rc2

7.0.19

7.0.19rc1

7.0.1rc1

7.0.1rc2

7.0.2

7.0.20

7.0.20rc1

7.0.21

7.0.22

7.0.22rc1

7.0.22rc2

7.0.22rc3

7.0.23

7.0.23rc1

7.0.23rc2

7.0.24rc1

7.0.24rc2

7.0.24rc3

7.0.2rc1

7.0.2rc2

7.0.3

7.0.3rc1

7.0.4

7.0.4rc1

7.0.5

7.0.5rc1

7.0.6

7.0.6rc1

7.0.7

7.0.7rc1

7.0.8

7.0.8rc1

7.0.8rc2

7.0.9

7.0.9rc1

7.0.9rc2

7.4.0

7.4.1

7.4.1rc1

7.4.2

7.4.2rc1

7.4.2rc2

7.4.3

7.4.3rc1

7.4.4

7.4.4rc1

7.4.5

7.4.6

7.4.6rc1

7.4.6rc2

7.4.7

7.4.7rc1

7.4.7rc2

7.4.7rc3

7.4.8rc1

7.4.8rc2

7.4.8rc3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23926.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "2575989339259640105311353590351376328",
                "261745388088049729003388450910874131284",
                "78615119555629258408370069502963169562",
                "106265636532305374733445754623506502550",
                "142981670864924541529460717571059194747",
                "276456720699755867738555225603931221904"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23926-3c3866b9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/6b0f6b25da00d2c2a0dc2035ba2285aa51c85865",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "328694341909655700810807882163230140941",
                "12061819213497335241319149757757382988",
                "8781501731097225876935453466613140553",
                "132482256639643116861018651525990961205",
                "188121564415475832297632590253969155136",
                "36080719019429417973525356404344529663"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23926-92c6c503",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/36bdd34b378e8731c7c825df38c364e00a76e6a5",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    }
]

vanir_signatures_modified

"2026-09-20T14:24:11Z"