CVE-2025-27238

LOW

API hostprototype.get lists data to users with insufficient authorization.

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-27238 has a selected CVSS score of 2.1 (low).

Description

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 12, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zabbix

Browse Zabbix / Zabbix

Default status: unknown

CVE List7.0.0 to ≤ 7.0.13affected
7.2.0 to ≤ 7.2.7affected

References

2