Zabbix Email Media OAuth URL Injection RCE via Import
CVE-2026-59788 Published on October 5, 2026
Stored XSS vulnerability in OAuth configuration form
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.
Vulnerability Analysis
CVE-2026-59788 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-59788 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-59788
Want to know whenever a new CVE is published for Zabbix? stack.watch will email you.
Affected Versions
Zabbix:- Version 7.4.0, <= 7.4.11 is affected.