An authenticated user can trigger a significant CPU load on the Zabbix frontend webserver by sending specially crafted requests to the validate.api.exists action, resulting in a denial of service. This vulnerability allows an attacker to paralyze the frontend when enough requests are made, but it does not affect the backend or database components.

The affected product is Zabbix. Specific version information is not provided in the CVE, so all deployments that include the validate.api.exists endpoint may be impacted. Administrators should verify the installed version and consult the Zabbix support portal for the patched release.

The CVSS score of 5.1 indicates a medium severity vulnerability. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exploitation likelihood appears low to moderate. However, the patch requires proper authentication, so an authenticated attacker with access to the Zabbix frontend can exploit the issue. Networks that have exposed the frontend to internal or potentially external users could be particularly vulnerable if credentials are compromised.