Authorized User Can Add Themselves to Any Group, Except Disabled or Restricted Ones

CVE-2024-36467

What is CVE-2024-36467?

An authenticated user with API access, particularly those with permission to the user.update API endpoint, can exploit a vulnerability in Zabbix. This security issue allows the user to add themselves to any group, including privileged groups like Zabbix Administrators. However, the exploitation is limited to groups that are not disabled or have restricted GUI access. This highlights a potential risk for user role management and group permissions within Zabbix, necessitating immediate attention to protect sensitive data and maintain system integrity.

References