{
  "cveId": "CVE-2026-93483",
  "url": "https://patchblox.com/security/cve/CVE-2026-93483",
  "summary": "CVE-2026-93483 is fixed in znuny on 1 platform by DEBIAN-CVE-2026-93483 (version 6.5.25-1), released October 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "znuny: In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sen...",
  "description": "In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable \u0022Remote-User\u0022 request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.",
  "published": "2026-10-15T04:18:30Z",
  "severity": "",
  "epss": 0.00234,
  "epssPercentile": 0.14405,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "znuny",
      "release": "Debian 14",
      "fixedVersion": "6.5.25-1",
      "fix": "DEBIAN-CVE-2026-93483",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93483",
      "released": "2026-10-16T15:52:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}