Skip to content
OpenAdvisories
Medium WID-SEC-2026-1000 10 CVEs

Zammad: Mehrere Schwachstellen

Published Apr 7, 2026 · Updated Apr 8, 2026 · Revision 2 · de-DE

Vendor: zammad Product: zammad Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Zammad ist ein Helpdesk- und Ticketsystem.

Vulnerabilities 10

  • High 8.7
    CVE-2026-34723

    Zammad has incorrect access control in getting_started_controller

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was co…

    zammad zammad
  • High 8.7
    CVE-2026-34724 Public exploit

    Zammad has a server-side template injection leading to RCE via AI Agent

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrich…

    zammad zammad
  • High 8.3
    CVE-2026-34719

    Zammad has a Server-side request forgery (SSRF) via webhooks

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was che…

    zammad zammad
  • Medium 6.9
    CVE-2026-34722

    Zammad is missing authorization in ticket create endpoint

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.

    zammad zammad
  • Medium 5.9
    CVE-2026-34721

    Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 an…

    zammad zammad
  • Medium 5.3
    CVE-2026-34718

    Zammad improperly neutralizes of script-related HTML tags in ticket articles

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Z…

    zammad zammad
  • Medium 5.3
    CVE-2026-34782

    Zammad has improper access control in AI assistance controller for text tools

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all s…

    zammad zammad
  • Medium 5.3
    CVE-2026-34837

    Zammad is miissing authorization in AI assistance controller for context data used in text tools

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt…

    zammad zammad
  • Low 2.3
    CVE-2026-34720

    Zammad has an origin validation error in SSO mechanism

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fix…

    zammad zammad
  • Low 2.1
    CVE-2026-34248

    Zammad has an information disclosure in ticket detail view of customers in shared organizations

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at a…

    zammad zammad

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-20566, EUVD-2026-20564, EUVD-2026-20563, EUVD-2026-20562, EUVD-2026-20561, EUVD-2026-20560, EUVD-2026-20559, EUVD-2026-20558, EUVD-2026-20568, EUVD-2026-20556

  2. #1

    Initiale Fassung

References