Arbitrary Key Injection in Znuny Affecting User Preferences
CVE-2025-43926

6.1MEDIUM

Key Information:

Vendor

Znuny

Status
Znuny
Vendor
CVE Published:
8 May 2025

What is CVE-2025-43926?

An issue has been identified in Znuny versions 6.5.14 and 7.x up to and including 7.1.6, where custom AJAX calls to the AgentPreferences UpdateAJAX subaction can potentially manipulate user preferences using arbitrary keys. This could allow unauthorized changes to user settings, as the system retrieves these arbitrary keys and values through the GetUserData function. The implications of this vulnerability could impact user permissions and application behavior, requiring immediate attention to mitigate potential security risks.

References

https://znuny.com
https://www.znuny.org/en/advisories/zsa-2025-07

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.