CVE-2026-59788 in Zabbix
Summary
by MITRE • 10/05/2026
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability described involves a critical flaw within the email media type OAuth form implementation, specifically concerning how the Authorization endpoint value is processed before being passed to the browser's window.open() function. This security lapse stems from an absence of rigorous input validation regarding the URL scheme provided by the user or system configuration. In standard web application development, when constructing URLs for navigation or opening new windows, it is imperative to sanitize inputs to ensure they adhere to expected protocols such as HTTP or HTTPS. The failure to validate that the Authorization endpoint begins with a safe protocol allows an attacker to inject malicious payloads directly into this parameter. By supplying a javascript: URL scheme instead of a legitimate web address, the application inadvertently executes arbitrary JavaScript code within the context of the browser window opened by the function. This represents a classic instance of Cross-Site Scripting, specifically categorized under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation. The root cause lies in the lack of strict allow-listing or validation mechanisms for URL schemes, permitting script execution where only navigational URLs were intended.
The operational impact of this vulnerability is severe due to its potential delivery mechanism and privilege level. The flaw can be exploited through a crafted media type configuration file that an administrator must import into the system. This import process typically requires elevated privileges or specific administrative actions, making it a plausible attack vector for insiders or attackers who have gained access to administrative interfaces. Once the malicious configuration is imported, any Super Admin user who subsequently grants consent during the OAuth flow will trigger the execution of the injected JavaScript code. Because this script runs in the context of an authenticated session with super-administrator privileges, the attacker gains full control over the application's functionality on behalf of that high-privilege account. This can lead to complete system compromise, including data exfiltration, modification of critical configurations, installation of backdoors, or further lateral movement within the network infrastructure. The ability to execute code as a Super Admin significantly amplifies the risk profile, transforming what might otherwise be a low-severity input validation issue into a high-impact remote code execution scenario via social engineering or configuration manipulation.
From an offensive security perspective, this vulnerability aligns with several tactics and techniques outlined in the MITRE ATT&CK framework. The initial access vector corresponds to T1505.003, Server Software Component: Web Shell, although more accurately it fits under T1059.007, Command and Scripting Interpreter: JavaScript, as arbitrary code is executed within the browser environment. The exploitation relies on user interaction, specifically an administrator granting consent, which relates to T1204.002, User Execution: Malicious Link or Resource. Furthermore, because the attack involves manipulating a configuration file that is imported into the system, it also touches upon T1505.003 if interpreted as planting malicious components, but primarily it represents an abuse of legitimate administrative tools to achieve code execution. The persistence and impact are heightened by the fact that the executed script operates with the highest level of privilege available in the application, allowing for immediate and extensive damage without needing further escalation steps.
Mitigation strategies must focus on strict input validation and secure coding practices. Developers should implement a rigorous allow-list approach for URL schemes, ensuring that only http: and https: protocols are accepted as valid values for the Authorization endpoint parameter. Any other scheme, including javascript:, data:, or file:, should be rejected immediately with an appropriate error message logged for security auditing purposes. Additionally, implementing Content Security Policy (CSP) headers can provide a layer of defense-in-depth by restricting the sources from which scripts can be executed, thereby mitigating the impact even if input validation is bypassed. It is also crucial to review all administrative import functions to ensure that user-supplied data within configuration files undergoes the same level of sanitization as direct form inputs. Regular security code reviews and automated static analysis tools configured to detect unsafe use of window.open() with unsanitized variables can help identify such vulnerabilities early in the development lifecycle. Finally, limiting the scope of OAuth consent grants where possible reduces the potential impact if an attacker successfully exploits this flaw, ensuring that even a compromised Super Admin session does not automatically grant unrestricted access to all system resources.