Zabbix: The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is… (CVE-2026-59788)
Description
A vulnerability in Zabbix's email media type OAuth form allows execution of arbitrary JavaScript in the browser by passing an unvalidated Authorization endpoint URL to window.open(). This can be exploited by importing a crafted media type configuration file, resulting in script execution with Super Admin privileges.
CVSS v4.0
Affected software
pkg:deb/ubuntu/zabbix?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/zabbix?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/zabbix?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/zabbix?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/zabbix?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/zabbix?arch=source&distro=stonkingpkg:deb/ubuntu/zabbix?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The email media type OAuth form in Zabbix passes the Authorization endpoint value directly to window.open() without validating the URL scheme. This lack of validation allows a crafted javascript: URL to be executed in the browser context. An attacker can deliver a malicious media type configuration as an import file, which when processed, runs arbitrary JavaScript as the Super Admin user who grants consent. This vulnerability affects multiple specific Zabbix package versions listed, and no patch or remediation details are provided in the input data.
Potential Impact
Successful exploitation results in arbitrary JavaScript execution in the browser with Super Admin privileges, potentially allowing full control over the Zabbix instance from the perspective of the affected user. This can lead to unauthorized actions and compromise of the monitoring system's integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid importing untrusted media type configuration files and restrict Super Admin privileges to trusted users only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-59788
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ad3f5d72cdf04f656662e02
Added to database: 10/17/2026, 22:25:27 UTC
Last enriched: 10/18/2026, 00:29:03 UTC
Last updated: 10/18/2026, 00:29:03 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.