CVE-2025-27238

published 2025-09-12

CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

Priority P4 15 low 3.5 CVSS 3.1

AV A AC L PR L UI N S U C L I N A N

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	zabbix	< zabbix 1:7.0.22+dfsg-1 (forky)	zabbix 1:7.0.22+dfsg-1 (forky)
zabbix	zabbix	>= 0 < 1:7.0.22+dfsg-1~deb13u1	1:7.0.22+dfsg-1~deb13u1
zabbix	zabbix	>= 0 < 1:7.0.22+dfsg-1	1:7.0.22+dfsg-1
zabbix	zabbix	>= 7.0.0 < 7.0.14	7.0.14
zabbix	zabbix	7.0.0 – 7.0.13	—
zabbix	zabbix	>= 7.2.0 < 7.2.8	7.2.8
zabbix	zabbix	7.2.0 – 7.2.7	—

CVSS provenance

nvd v3.1 3.5 LOW CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvd v4.0 2.1 LOW CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 2.1 LOW

vendor_debian 2.1 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284