Unauthorized Access Vulnerability in Znuny Software
CVE-2026-93483

9.5CRITICAL

Key Information:

Vendor

Znuny

Status
Znuny
Vendor
CVE Published:
15 October 2026

What is CVE-2026-93483?

In Znuny version 7.3.6, a significant vulnerability permits attackers to bypass standard login procedures. By manipulating specific HTTP request headers, unauthorized users can gain access to sensitive system functionalities. The vulnerability arises from the application’s reliance on unvalidated headers, allowing attackers to impersonate any legitimate user, including administrators, without needing valid credentials. This flaw specifically affects the HTTPBasicAuth authentication modules for both agent and customer interfaces, heightening security risks through potential unauthorized access to confidential data and system controls.

Affected Version(s)

Znuny 0 < 6.5.25

Znuny 7.0.0 < 7.3.7

References

https://www.znuny.org/advisories
https://www.znuny.org/en/advisories/zsa-2026-14

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.