An authenticated Zabbix user with template/host write permissions can use the configuration.import API to create new objects. This allows the user to add unauthorized hosts to the system, leading to potential confidentiality loss. The vulnerability originates from insufficient validation of user permissions for the import operation. The issue reflects an authorization flaw (CWE-266) and privilege escalation via API import (CWE-863).

The affected product is Zabbix from the Zabbix vendor. Version information is not provided in the advisory, so the issue may affect any Zabbix installation that has not applied the published patch.

The CVSS score of 5.1 indicates a medium severity level. The EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based via the web API, requiring only authentication with sufficient write permissions. Successful exploitation would allow an attacker to create unauthorized hosts and potentially gain further access to the monitored infrastructure.