CVE-2025-27232: Zabbix Frontend

Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days.

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.

Affected products

• Zabbix Frontend: from 7.4.0, before 7.4.3 (fixed in 7.4.3)

Published 2025-12-01. Last modified 2026-09-26.