CVE-2026-23922

MediumCVSS 4.9/10Last modified Sep 8, 2026

Description

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Aug 18, 2026
Last modified: Sep 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239235.3An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on e CVE-2026-239244.9Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An CVE-2026-239258.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. Th CVE-2026-239266.8An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens CVE-2026-239276.5A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connectin CVE-2026-239286.8The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabl CVE-2026-239295.4Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filteri CVE-2026-23937.1A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/ser CVE-2026-239307.5An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the CVE-2026-239314.3The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potentia CVE-2026-239339.1In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only CVE-2026-239346.5An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the F