CVEvulnerability

CVE-2026-23923

6.9 MEDIUM Published 2026-03-24 Modified 2026-09-10 Official page ↗
Status
Analyzed
Published
2026-03-24
Last modified
2026-09-10
Assigner
[email protected]
CVSS 4.0 ([email protected])
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-470

Description

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

Affected configurations

• zabbix zabbix (>= 7.4.0 < 7.4.7)

Related

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References