{"id":"CVE-2026-23919","title":"For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks)","summary":"For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data…","severity":"medium","cvss":6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-488"],"vendor":"zabbix","product":"zabbix","affected":["zabbix >= 6.0.0, < 6.0.42","zabbix >= 7.0.0, < 7.0.19","zabbix >= 7.2.0, < 7.2.13","zabbix >= 7.4.0, < 7.4.3"],"patched":["zabbix 7.4.3"],"published":"2026-03-24","updated":"2026-09-18","sourceUpdated":"2026-09-18T17:07:18.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23919","references":[{"url":"https://support.zabbix.com/browse/ZBX-27638","label":"security@zabbix.com"}],"tags":["nvd"],"epss":0.00244,"epssPercentile":0.15829,"ingestedAt":"2026-09-18T17:46:41.511Z","slug":"CVE-2026-23919","body":"## Overview\n\nFor performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.\n\n## Affected\n\n- `zabbix >= 6.0.0, < 6.0.42`\n- `zabbix >= 7.0.0, < 7.0.19`\n- `zabbix >= 7.2.0, < 7.2.13`\n- `zabbix >= 7.4.0, < 7.4.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `zabbix 7.4.3`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}