CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.

Score

CVSS 4.0 5.3 Medium

Status

Analyzed - security@zabbix.com

Published

2026-08-18

Last modified

2026-08-18

Weaknesses

CWE-203

Affected products

• Zabbix (Zabbix)

References

• https://support.zabbix.com/browse/ZBX-28070