CVE-2026-59788

EUVD-2026-92400
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
ZabbixCNA
5.6 MEDIUM
NETWORK
LOW
HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
zabbixzabbix
7.4.0 ≤
𝑥
≤ 7.4.11
CNA
Debian logo
Debian Releases
Debian Product
Codename
zabbix
bookworm
1:6.0.14+dfsg-1
fixed
forky
1:7.0.29+dfsg-2
fixed
sid
1:7.0.29+dfsg-2
fixed
trixie
1:7.0.22+dfsg-1~deb13u1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://support.zabbix.com/browse/ZBX-28198