A low‑privileged Zabbix user with API access can influence the sortfield parameter in the API to inject arbitrary, read‑only SQL statements. The injected SELECT commands do not return results directly, but an attacker can still extract database information by measuring timing responses or other side‑channels. This capability could lead to disclosure of session identifiers or even compromise of administrator accounts.

The vulnerability exists in Zabbix’s API component located in include/classes/api/CApiService.php. Versions affected are not explicitly enumerated in the advisory, so any deployment exposing the Zabbix API to users with API rights may be susceptible.

With a CVSS base score of 8.7, this issue is rated as high risk. The EPSS score is not available, and it is not listed in the CISA KEV catalog, though that is not a mitigation. An attacker only needs low‑privilege API access; the exploit requires normal network connectivity to the Zabbix server. Although direct data retrieval is not possible in the response, time‑based inference allows exfiltration, making the attack practical. The potential impact includes data confidentiality loss and possible administrative privilege escalation.