An authenticated administrator with non‑super user privileges can create a maintenance period containing JavaScript that runs whenever any user opens the tooltip for that maintenance period in the Host navigator widget. This stored XSS flaw (CWE‑79) allows the attacker to execute arbitrary script within the context of any user viewing the tooltip, potentially enabling unauthorized actions such as data exfiltration or local privilege escalation.

Zabbix systems that include the Host navigator widget feature are affected. No specific version is listed in the CVE data, so all current installations that expose this widget are potentially impacted and should be verified against the latest vendor patch.

With a CVSS score of 7.3, the severity is high. The exploit is possible only after an authenticated non‑super administrator creates the malicious maintenance entry and then another user opens the tooltip, limiting the attack surface but still posing a significant risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet, but the potential remains. Patch the affected components or disable the widget to mitigate.