CVE-2026-59788mediumCWE-79

CVE-2026-59788: falha de média gravidade em Zabbix

Stored XSS vulnerability in OAuth configuration form

Publicada em 05 out 2026

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.6epss 0.3%

probabilidade de exploração

0.3%top 85% das CVEs

exploração observada

nãonenhuma fonte reporta

The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Zabbix · Zabbix

CVEs relacionadas — Zabbix

No mesmo produto, das mais perigosas para as menos.

CVE-2024-42327CRITICALSQL injection in user.get APIEPSS 78.7%CVE-2024-22120CRITICALTime Based SQL Injection in Zabbix Server Audit LogEPSS 76.6%CVE-2013-3628—CVE-2013-3628EPSS 67.5%CVE-2023-29452MEDIUMRemove possibility to add html into Geomap attribution fieldEPSS 64.1%CVE-2024-36465HIGHSQL injection in Zabbix APIEPSS 39.9%CVE-2026-23921HIGHBlind, read-only SQL injection in Zabbix API via sortfield parameterEPSS 3.9%

Referências

https://support.zabbix.com/browse/ZBX-28198