Zabbix: (The frontend validatate.api.exists action can be exploited by authenti ...) (CVE-2026-23931)

The vulnerability identified as CVE-2026-23931 involves the frontend validatate.api.exists action in Zabbix, which can be exploited by authenticated users. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond low privileges, no user interaction, and low impact on confidentiality, integrity, and availability. Affected versions include numerous Ubuntu-packaged Zabbix releases from 1:2.0.6+dfsg-1ubuntu2 through 1:7.0.22+dfsg-1. There is no vendor advisory or patch information provided, and no known exploits have been reported.

The impact is assessed as medium severity, reflecting limited impact on confidentiality, integrity, and availability with low complexity and no user interaction required. The vulnerability requires authentication with low privileges but does not escalate privileges or cause significant system compromise according to the CVSS vector. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor channels for updates. No specific mitigation steps are indicated in the available data.