CVE-2025-27238: 
Zabbix Server vulnerability analysis and mitigation

A security vulnerability (CVE-2025-27238) was discovered in the Zabbix API, affecting versions 7.0.0-7.0.13 and 7.2.0-7.2.7. The vulnerability allows users without assigned user groups to access host prototype data through the hostprototype.get method, potentially exposing sensitive system configuration information (Zabbix Issue).

The vulnerability exists in the Zabbix API's authorization mechanism, specifically affecting the hostprototype.get method. The issue has been assigned a CVSS v4.0 Base Score of 2.1 (Low) with the vector string CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-284 (Improper Access Control) (NVD).

The vulnerability allows unauthorized access to host prototype information, potentially exposing sensitive configuration details of the Zabbix monitoring system. Users without any assigned user groups can retrieve a list of all host prototypes from the API, which could provide attackers with valuable information about the monitored infrastructure (Zabbix Issue).

The vulnerability has been fixed in Zabbix versions 7.0.14 and 7.2.8. As a workaround, administrators should ensure that there are no Zabbix users without an assigned user group. The recommended mitigation is to update affected components to their respective fixed versions (Zabbix Issue).