Zabbix CVE-2026-59788

Exploitation requires that an attacker-crafted Zabbix media type configuration - specifically one using the email media type's OAuth flow with the 'Authorization endpoint' set to a javascript: scheme URL - be imported into the target Zabbix frontend, and then that a Super Admin opens that media type's OAuth form and actively clicks to grant consent, triggering the unvalidated window.open() call. Limiting factors that reduce real-world risk: the attacker cannot self-trigger the payload (requires a Super Admin's deliberate consent click, UI:A), importing a media type configuration itself requires high frontend privileges (PR:H), and the flaw is confined to the email media type's OAuth authorization form rather than any default, unauthenticated request path.

This is a genuine-but-constrained medium-severity issue (CVSS 4.0 base 5.6), not a mass-exploitation priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:A) tells a consistent story with the description: although the attack vector is 'Network', real exploitation is gated behind high privileges (PR:H - a Super Admin or equivalent must import the crafted media type configuration) AND active, deliberate user interaction (UI:A - a Super Admin must open the OAuth form and click to grant consent), plus a situational Attack Requirement (AT:P). These stacked prerequisites sharply reduce real-world risk despite CWE-79 (stored/DOM XSS) allowing arbitrary JavaScript to run in the Super Admin's authenticated session. No EPSS score, no SSVC decision, no POC, and no CISA KEV listing were provided in the input; absence of these is not itself evidence of safety but means there is no signal of active or probable near-term exploitation. The one signal that could appear contradictory - AV:N combined with PR:H and UI:A - is not actually conflicting: the payload is network-deliverable as an import file, but detonation still depends on a privileged human action, so this behaves far more like a targeted social-engineering / insider-leaning vector than an internet-wide drive-by.

An attacker crafts a malicious Zabbix media type export/import file whose email OAuth 'Authorization endpoint' is set to a javascript: URL. The file is delivered to and imported by a privileged Zabbix user (e.g., via a shared 'community' template or social engineering); when a Super Admin later opens the OAuth form and clicks to grant consent, window.open() executes the attacker's JavaScript in the Super Admin's authenticated frontend session. No public exploit code was identified in the provided data, but the technique is straightforward to reproduce.