ZSA-2026-14

Date: 2026-09-16
Affected: All versions of Znuny LTS from 6.5.1 up to including 6.5.24.
All versions of Znuny from 7.3.1 up to including 7.3.6.
All versions of Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, and 7.2.
Severity: high
CVE: Requested

The HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.

Fixed in: Znuny LTS 6.5.25 and Znuny 7.3.7

Thanks for reporting to Mokrane ABDELMALEK (via the Ghent University VDP programme).