CVE-2025-27232: An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential c

CVE-2025-27232 · Severity: medium · CVSS 4.9 · Published 2025-12-01

Technologies: Zabbix Frontend. Vendors: Zabbix.

Executive brief

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.

Affected products

Zabbix Frontend

Related threats

Zabbix Frontend denial of service via validate.api.exists
Zabbix Frontend Authentication Bypass Vulnerability
Zabbix Frontend Improper Access Control Vulnerability