CVE-2026-93483
9.5CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-348
Impact
Unauthenticated remote attackers can impersonate any user, including administrators, and take full control of the application without credentials. They only need network access to an instance configured with HTTPBasicAuth.
Root cause
The HTTPBasicAuth authentication modules fall back to reading the username from the untrusted, client-controlled Remote-User HTTP header ($ENV{HTTP_REMOTE_USER}).
Affected systems
Znuny through 7.3.6 using HTTPBasicAuth
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Red
Fix & remediation
Upgrade to a version higher than 7.3.6 (check vendor advisory ZSA-2026-14). As an immediate mitigation, strip the Remote-User header at your reverse proxy or web server, or switch away from the HTTPBasicAuth authentication module in Kernel/Config.pm.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.