The vulnerability identified as CVE-2026-23922 in Zabbix concerns the inability to read the 'Client secret' field in the email media OAuth configuration after it has been saved. This affects numerous specific versions of Zabbix packaged for Ubuntu distributions, including versions from 2.0.6 through 7.0.22 in various builds. The CVSS 4.0 vector indicates network attack vector, low complexity, partial attack traceability, high privileges required, no user interaction, and low impact on confidentiality with no impact on integrity or availability. There are no known exploits in the wild and no vendor advisory or patch information is provided.

The impact is limited to the inability to read the OAuth 'Client secret' field after saving, which may affect configuration management or operational functionality related to email media in Zabbix. The CVSS score suggests a medium severity with low confidentiality impact and no integrity or availability impact. There is no evidence of active exploitation or broader system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, review configuration practices for OAuth client secrets and consider alternative notification methods if this issue affects operations.