In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by… (CVE-2026-93483)

In Znuny through version 7.3.6, the HTTPBasicAuth modules for agent and customer interfaces read the username from the environment variable HTTP_REMOTE_USER, which is directly populated from the attacker-controllable 'Remote-User' HTTP header. Because the application incorrectly trusts this header as a fallback authentication source, an attacker can forge this header to impersonate any existing user without providing credentials, bypassing authentication controls and gaining full access to sensitive system functions.

An attacker can gain unauthorized access to any user account, including administrative accounts, without needing valid credentials. This leads to full access to confidential data and system controls, potentially compromising the entire system's security and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using HTTPBasicAuth as the authentication backend or configure the system to not trust the 'Remote-User' HTTP header for authentication fallback.