Read the docs
TI-2026-74584 Aliases CVE-2026-93483GHSA-g4fx-r8m5-c6r7

Authentication bypass in Znuny via forged Remote-User header

Priority MEDIUM 42CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Znuny through 7.3.6 trusts an attacker-controllable Remote-User HTTP request header in its HTTPBasicAuth login modules for the agent and customer interfaces. Because the modules fall back to $ENV{HTTP_REMOTE_USER} when REMOTE_USER is not set, an unauthenticated remote attacker can log in as any existing user, including administrators, without a password. This is an authentication bypass classified as CWE-348 (use of less trusted source), and it grants full access to confidential data and system controls on systems that use HTTPBasicAuth as the authentication backend.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Fix Fixed Znuny (Znuny): 6.5.25, 7.3.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZnunyZnunybefore 6.5.25; 7.0.0 to before 7.3.76.5.25, 7.3.7Patch availableCNA
  • Znuny VendorZnuny Affected before 6.5.25; 7.0.0 to before 7.3.7 Fixed in 6.5.25, 7.3.7 Patch available CNA

Remediation

Upgrade Znuny to version 6.5.25 or 7.3.7, whichever matches the installed release.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Znuny (Znuny) Fixed in 6.5.25, 7.3.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Znuny 6.5.25, 7.3.7

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-74585 SQL injection in Znuny ticket search via ContentSearch parameterPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-93483
  2. 2026-10-16 Alias added: GHSA-g4fx-r8m5-c6r7
  3. 2026-10-20 CISA SSVC decision points changed

References

Other 2

  • TI-2025-19719 An issue was discovered in Znuny before 7.1.4. CVSS 3.1CRITICAL 9.8
  • TI-2025-19718 An Eval Injection issue was discovered in Znuny through 7.1.3. CVSS 3.1CRITICAL 9.8
  • TI-2025-19717 An issue was discovered in Znuny through 7.1.3. CVSS 3.1CRITICAL 9.8
  • TI-2025-19720 An issue was discovered in Znuny before 7.1.5. CVSS 3.1CRITICAL 9.1
  • TI-2024-21383 An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1… CVSS 3.1CRITICAL 9.8
  • TI-2026-74585 SQL injection in Znuny ticket search via ContentSearch parameter CVSS 4.0HIGH 8.6
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences