{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"znuny","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NNX08GV500BNB54Q3EQ3ZE","modified_at":"2026-09-01T20:05:52.668894393Z","published_at":"2025-05-08T16:15:26.317Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-43926","https://security-tracker.debian.org/tracker/CVE-2025-43926"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-43926","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-43926"}],"summary":"An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetc"}