---
id: "CVE-2022-23134"
kind: "vulnerability"
aliases: ["CVE-2022-23134"]
title: "Zabbix Frontend: Zabbix Frontend Improper Access Control Vulnerability"
severity: "medium"
cvss: 5.3
epss: 0.9526
exploited: true
status: "open"
category: "other"
products: [{"name": "Zabbix Frontend", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "other", "self-hosted", "zabbix"]
not_affected_if: ["unknown"]
published_at: "2022-01-13T16:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23134", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23134", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23134", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Zabbix Frontend: Zabbix Frontend Improper Access Control Vulnerability

Zabbix Frontend has an improper access control flaw that lets malicious actors pass step checks and change the configuration of the Zabbix Frontend. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zabbix Frontend affected ? fixed ?

## Fix

Apply updates per vendor instructions (affected and fixed versions not stated in the sources).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23134
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-23134
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-23134

## From the sources

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_