CVE-2024-36467

What it actually does

An authenticated user with API access to the user.update endpoint can modify their own group memberships to escalate privileges to groups such as Zabbix Administrators, bypassing intended authorization controls except for disabled or GUI-restricted groups.

Why it matters to the business

Attackers who obtain basic user credentials can gain full administrative control over the monitoring system, exposing sensitive infrastructure data, configuration changes, and potential for further compromise across monitored environments.

How an attack unfolds

An attacker authenticates with a low-privilege account that has API access, then issues a crafted user.update call to add their account to a high-privilege group such as Zabbix Administrators, after which they can perform any administrative actions via the web interface or API.

How to fix it

Upgrade zabbix/zabbix to commit d1b0c3308ce91271f6a8a28a3ad78df4295807f5 or later; restrict API access for non-administrative roles until patched; review and audit existing user group memberships.

How to confirm the fix worked

Confirm the deployed version includes commit d1b0c3308ce91271f6a8a28a3ad78df4295807f5; test that a non-admin user cannot successfully call user.update to join an administrative group; review API access logs for unauthorized group modifications.

Typical attack path

1. Obtain valid low-privilege credentials with API access
2. Call the user.update API endpoint with parameters to add the account to a target group
3. Verify group membership change via API or UI
4. Perform administrative actions using the newly acquired privileges

How to detect it

Search API and application logs for user.update calls that include groupid or usrgrpid parameters originating from non-admin accounts; correlate with successful group membership changes in the users table or audit records.

• user.update
• usrgrpid
• groupid

What your security team should do

• Apply the fix by updating to the referenced commit immediately given the authorization bypass nature
• Limit API permissions for default User roles to the minimum required
• Enable detailed logging of user.update API calls and monitor for group changes
• Perform an audit of current user-to-group assignments across the instance