CVE-2026-23921
Fixed in a distro release EPSS 4%CVSS 8.7
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
Products: Zabbix
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | zabbix | no fix |
| Debian 13 | zabbix | 1:7.0.22+dfsg-1~deb13u1 |
| Debian 14 | zabbix | 1:7.0.22+dfsg-1 |
| Ubuntu 25.10 | zabbix | no fix |
| Ubuntu Pro 14.04 LTS | zabbix | no fix |
| Ubuntu Pro 16.04 LTS | zabbix | no fix |
| Ubuntu Pro 18.04 LTS | zabbix | no fix |
| Ubuntu Pro 20.04 LTS | zabbix | no fix |
| Ubuntu Pro 22.04 LTS | zabbix | no fix |