Zabbix API Hostprototype.get Authorization Vulnerability

A vulnerability exists in the Zabbix API within the hostprototype.get method, which improperly exposes all host prototypes to users lacking any assigned user groups. This issue affects Zabbix versions 7.0.0 through 7.0.13 and 7.2.0 through 7.2.7. The vulnerability arises from a bug that allows users with low-privilege accounts and no user roles to access a complete list of host prototypes via the API.

Impact

Exploitation of this vulnerability allows for unauthorized access to all host prototypes, potentially leading to information disclosure.

Remediation

Users can update to Zabbix version 7.0.14 or 7.2.8, depending on their current version. Additionally, ensure that all Zabbix users are assigned to a user group to prevent exposure.