The vulnerability arises from the reuse of JavaScript (Duktape) execution contexts in Zabbix Server and Proxy, allowing a non‑super administrator to craft or trigger scripts that read data from hosts they normally cannot access. This leads to the disclosure of sensitive configuration or credentials, impairing confidentiality. The weakness is identified as CWE‑488, reflecting improper isolation of execution contexts.

All Zabbix Server and Proxy installations that employ the default Duktape context reuse are impacted. Any instance that has not applied the patch that enforces read‑only built‑in JavaScript objects remains vulnerable, regardless of major release.

With a CVSS score of 7.1 the flaw is of medium to high severity, yet it is not listed in the CISA Known Exploited Vulnerabilities catalog and EPSS information is unavailable. The attack vector is local; an attacker can exploit the issue by creating or editing JavaScript preprocessing scripts, a capability granted to regular administrators. The resulting harm is confined to information disclosure, but can be significant if confidential data is exposed.