DEBIAN-CVE-2026-23926
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-23926
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23926.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-23926
- Upstream
- Published
- 2026-05-06T08:16:01Z
- Modified
- 2026-09-19T23:00:07Z
- Severity
-
- 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.
- References
Affected packages
Debian:12 / zabbix
Package
- Name
- zabbix
- Purl
- pkg:deb/debian/zabbix?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1:6.*
1:6.0.14+dfsg-1
1:6.0.23+dfsg-1~bpo12+1
1:6.0.23+dfsg-1
1:6.0.24+dfsg-1
1:6.0.25+dfsg-1
1:6.0.29+dfsg-1
1:7.*
1:7.0.0+dfsg-1
1:7.0.0+dfsg-2~bpo12+1
1:7.0.0+dfsg-2
1:7.0.1+dfsg-1~bpo12+1
1:7.0.1+dfsg-1
1:7.0.2+dfsg-1~bpo12+1
1:7.0.2+dfsg-1
1:7.0.3+dfsg-1
1:7.0.5+dfsg-1~bpo12+1
1:7.0.5+dfsg-1
1:7.0.6+dfsg-1
1:7.0.9+dfsg-1~bpo12+1
1:7.0.9+dfsg-1
1:7.0.10+dfsg-1
1:7.0.10+dfsg-2
1:7.0.22+dfsg-1~bpo13+1
1:7.0.22+dfsg-1~deb13u1
1:7.0.22+dfsg-1
1:7.0.22+dfsg-1.1
1:7.0.27+dfsg-1
1:7.0.29+dfsg-1
1:7.0.29+dfsg-2
Debian:13 / zabbix
Package
- Name
- zabbix
- Purl
- pkg:deb/debian/zabbix?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / zabbix
Package
- Name
- zabbix
- Purl
- pkg:deb/debian/zabbix?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:7.0.27+dfsg-1