Znuny CVE-2026-93483

Exploitation requires that Znuny be configured to use the HTTPBasicAuth backend (Kernel::System::Auth::HTTPBasicAuth for agents and/or Kernel::System::CustomerAuth::HTTPBasicAuth for customers) as the authentication module - this is the AT:P attack requirement and is NOT the default configuration. It additionally requires that the fronting web server does not strip or sanitize an inbound 'Remote-User' request header, so that it reaches the Perl process as $ENV{HTTP_REMOTE_USER}. When those conditions hold, exploitation is remote, unauthenticated, and needs no user interaction: the attacker simply supplies a Remote-User header naming any existing account. The decisive limiting factor is the non-default HTTPBasicAuth backend; installations using the default DB or LDAP authentication backends are not affected.

This is a genuine high-priority vulnerability, not an inflated CVSS score. CWE-348 (Use of Less Trusted Source) combined with the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H) describes a trivial, remote, unauthenticated, credential-less authentication bypass yielding administrator impersonation - the worst-case outcome for a helpdesk/ticketing platform holding confidential customer data. The single mitigating signal is AT:P (Attack Requirements: Present), which correctly reflects that exploitation is possible ONLY when the HTTPBasicAuth backend (Kernel::System::Auth::HTTPBasicAuth / CustomerAuth::HTTPBasicAuth) is the configured authentication module - a non-default, environment-specific deployment choice. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation-probability and in-the-wild signals are UNKNOWN rather than low; absence of these data points should not be read as low risk given how simple the forged-header technique is. Signals are internally consistent (network vector matches an HTTP-header-based attack; PR:N matches 'without providing any credentials'), so there is no contradiction to flag - the only material caveat is that real-world exposure is gated entirely by whether HTTPBasicAuth is in use.

An attacker reaches the Znuny agent or customer web interface over the network and sends a normal HTTP request with a forged 'Remote-User: admin' header. Because the HTTPBasicAuth module falls back to the attacker-controllable $ENV{HTTP_REMOTE_USER} when the web-server-set REMOTE_USER is absent, the application logs them in as that user with no password, granting full administrative access to tickets, confidential data, and system configuration. No public exploit code was identified at time of analysis, but the technique requires only a single crafted header and no tooling.