CVE-2026-23921

HighCVSS 8.8/10Last modified Sep 10, 2026

Description

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2026
Last modified: Sep 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239224.9The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoin CVE-2026-239235.3An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on e CVE-2026-239244.9Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An CVE-2026-239258.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. Th CVE-2026-239266.8An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens CVE-2026-239276.5A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connectin CVE-2026-239286.8The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabl CVE-2026-239295.4Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filteri CVE-2026-23937.1A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/ser CVE-2026-239307.5An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the CVE-2026-239314.3The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potentia CVE-2026-239339.1In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only