A flaw in the frontend validate.api.exists API call in Zabbix allows an authenticated user to retrieve the plaintext values of user macros, potentially exposing sensitive configuration or credential data and causing confidentiality loss. The weakness aligns with CWE-203, Sensitive Information Exposure, as the data is exposed without proper authorization checks.

The issue affects Zabbix products where the validate.api.exists action is implemented. No specific version numbers are listed, but the vendor advises applying the patched components available in the latest releases. Administrators should verify that their deployments include the unpatched frontend modules.

The CVSS score of 5.3 indicates moderate impact. The EPSS is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation yet. The exploit requires valid user credentials, so any account with sufficient permissions could leverage it. The attack vector is thus through authenticated access to the Zabbix UI, extracting macro data before encryption or obfuscation is applied.