{"id":"CVE-2026-23921","title":"A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter","summary":"A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned dire…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"zabbix","product":"zabbix","affected":["zabbix >= 7.0.0, < 7.0.22","zabbix >= 7.2.0, < 7.2.15","zabbix >= 7.4.0, < 7.4.6"],"patched":["zabbix 7.4.6"],"published":"2026-03-24","updated":"2026-09-10","sourceUpdated":"2026-09-10T21:13:20.120","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23921","references":[{"url":"https://support.zabbix.com/browse/ZBX-27640","label":"security@zabbix.com"}],"tags":["nvd","exploit-available"],"epss":0.03499,"epssPercentile":0.88645,"exploits":{"github":1,"githubRepos":["https://github.com/RichJJ98/analise-vulnerabilidades-zabbix-notebooklm"],"checkedAt":"2026-09-23T07:13:55.585Z"},"exploitAvailable":true,"ingestedAt":"2026-09-10T22:07:00.625Z","slug":"CVE-2026-23921","body":"## Overview\n\nA low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.\n\n## Affected\n\n- `zabbix >= 7.0.0, < 7.0.22`\n- `zabbix >= 7.2.0, < 7.2.15`\n- `zabbix >= 7.4.0, < 7.4.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `zabbix 7.4.6`","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.7,"exploitation":12,"ransomware":0},"changes":[]}