-
Type:
Defect (Security)
-
Resolution: Fixed
-
Priority:
Major
-
None
-
Affects Version/s: None
-
Component/s: Frontend (F)
-
None
| CVE ID | CVE-2026-23926 |
| CVSS score | 7.3 (High) |
| CVSS vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Affected components | Frontend |
| Summary | Stored XSS vulnerability in Host navigator widget maintenance tooltip |
| Description | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip. |
| Known attack vectors | An attacker creating a malicious maintenance period that must then be shown and opened via the Host navigator widget. |
| Affected and fix version/s | Affected: 7.0.0 - 7.0.23 → Fixed: 7.0.24 Affected: 7.4.0 - 7.4.7 → Fixed: 7.4.8 |
| Mitigation | Update the affected components to their respective fixed versions. |
| Workarounds | Disable the Host navigator widget via Administration -> General -> Modules. |
| Acknowledgements | Zabbix wants to thank Daniel Santos (@bananabr) for submitting this report on the HackerOne bug bounty platform. |