Zabbix: The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. (CVE-2026-23922)

The vulnerability in Zabbix concerns the email media OAuth configuration where the 'Client secret' field is protected from direct reading after saving. However, a Super Admin user can exploit this by setting a malicious 'Token endpoint' URL, which can lead to leakage of the client secret. To address this, the software was updated to reset the client secret whenever the token endpoint is changed, reducing the risk of secret exposure through this vector.

The vulnerability allows a Super Admin to potentially leak the OAuth client secret by manipulating the token endpoint. This could compromise the confidentiality of the client secret, but does not affect integrity or availability. The CVSS score of 4.9 (medium severity) reflects the need for high privileges (Super Admin) to exploit and the limited scope of impact to confidentiality only.

A fix is available that resets the client secret upon changing the token endpoint, preventing leakage via this method. Users should apply the updated versions of Zabbix that include this change. Since the vulnerability requires Super Admin privileges, limiting such privileges and applying the patch will mitigate the risk effectively.