DEBIAN-CVE-2026-93483

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-93483
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93483.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-93483
Upstream
Published
2026-10-15T04:18:30Z
Modified
2026-10-16T09:47:35Z
Severity
  • 9.5 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Red CVSS Calculator
Summary
[none]
Details

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.

References

Affected packages

Debian:12 / znuny

Package

Name
znuny
Purl
pkg:deb/debian/znuny?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.3.2-3
6.3.3-1~bpo11+1
6.3.3-1
6.3.4-1~bpo11+1
6.3.4-1
6.4.2-1~bpo11+1
6.4.2-1
6.4.2-2
6.4.3-1~bpo11+1
6.4.3-1
6.4.4-1
6.4.5-1~bpo11+1
6.4.5-1
6.4.5-2
6.5.1-1
6.5.3-1~bpo12+1
6.5.3-1
6.5.4-1~bpo12+1
6.5.4-1
6.5.5-1~bpo12+1
6.5.5-1
6.5.6-1~bpo12+1
6.5.6-1
6.5.8-1~bpo12+1
6.5.8-1
6.5.9-1~bpo12+1
6.5.9-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.11-1~bpo12+1
6.5.11-1
6.5.13-1
6.5.14-1~bpo12+1
6.5.14-1
6.5.15-1
6.5.15-2~bpo12+1
6.5.15-2
6.5.16-1
6.5.18-1~bpo13+1
6.5.18-1
6.5.19-1
6.5.20-1
6.5.21-1
6.5.22-1~bpo13+1
6.5.22-1
6.5.23-1~bpo13+1
6.5.23-1
6.5.24-1~bpo13+1
6.5.24-1
6.5.25-1~bpo13+1
6.5.25-1
6.5.26-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93483.json"

Debian:13 / znuny

Package

Name
znuny
Purl
pkg:deb/debian/znuny?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.3.2-3
6.3.3-1~bpo11+1
6.3.3-1
6.3.4-1~bpo11+1
6.3.4-1
6.4.2-1~bpo11+1
6.4.2-1
6.4.2-2
6.4.3-1~bpo11+1
6.4.3-1
6.4.4-1
6.4.5-1~bpo11+1
6.4.5-1
6.4.5-2
6.5.1-1
6.5.3-1~bpo12+1
6.5.3-1
6.5.4-1~bpo12+1
6.5.4-1
6.5.5-1~bpo12+1
6.5.5-1
6.5.6-1~bpo12+1
6.5.6-1
6.5.8-1~bpo12+1
6.5.8-1
6.5.9-1~bpo12+1
6.5.9-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.11-1~bpo12+1
6.5.11-1
6.5.13-1
6.5.14-1~bpo12+1
6.5.14-1
6.5.15-1
6.5.15-2~bpo12+1
6.5.15-2
6.5.16-1
6.5.18-1~bpo13+1
6.5.18-1
6.5.19-1
6.5.20-1
6.5.21-1
6.5.22-1~bpo13+1
6.5.22-1
6.5.23-1~bpo13+1
6.5.23-1
6.5.24-1~bpo13+1
6.5.24-1
6.5.25-1~bpo13+1
6.5.25-1
6.5.26-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93483.json"

Debian:14 / znuny

Package

Name
znuny
Purl
pkg:deb/debian/znuny?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.5.25-1

Affected versions

6.*
6.3.2-3
6.3.3-1~bpo11+1
6.3.3-1
6.3.4-1~bpo11+1
6.3.4-1
6.4.2-1~bpo11+1
6.4.2-1
6.4.2-2
6.4.3-1~bpo11+1
6.4.3-1
6.4.4-1
6.4.5-1~bpo11+1
6.4.5-1
6.4.5-2
6.5.1-1
6.5.3-1~bpo12+1
6.5.3-1
6.5.4-1~bpo12+1
6.5.4-1
6.5.5-1~bpo12+1
6.5.5-1
6.5.6-1~bpo12+1
6.5.6-1
6.5.8-1~bpo12+1
6.5.8-1
6.5.9-1~bpo12+1
6.5.9-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.11-1~bpo12+1
6.5.11-1
6.5.13-1
6.5.14-1~bpo12+1
6.5.14-1
6.5.15-1
6.5.15-2~bpo12+1
6.5.15-2
6.5.16-1
6.5.18-1~bpo13+1
6.5.18-1
6.5.19-1
6.5.20-1
6.5.21-1
6.5.22-1~bpo13+1
6.5.22-1
6.5.23-1~bpo13+1
6.5.23-1
6.5.24-1~bpo13+1
6.5.24-1
6.5.25-1~bpo13+1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93483.json"