Skip to content
OpenAdvisories
High WID-SEC-2026-1981 14 CVEs

Zammad: Mehrere Schwachstellen

Published Jun 16, 2026 · Updated Sep 27, 2026 · Revision 4 · de-DE

Vendor: zammad Product: zammad

Summary

Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Zammad ist ein Helpdesk- und Ticketsystem.

Vulnerabilities 14

  • High 8.7
    CVE-2026-56725

    Zammad: Denial of Service via OTRS Import Controller

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions …

    zammad zammad
  • High 8.7
    CVE-2026-56733

    Zammad: Incorrect Authorization and Improper Privilege Management

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions…

    zammad zammad
  • High 8.4
    CVE-2026-56731

    Zammad: Cross-Site Scripting in Ticket Notifications

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The ti…

    zammad zammad
  • High 7.1
    CVE-2026-13229

    Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

    Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.

    zammad zammad
  • High 7.1
    CVE-2026-56723

    Zammad: Missing authorization on ticket attachment download

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging t…

    zammad zammad
  • High 7.1
    CVE-2026-56724

    Zammad: Incorrect implementation of permission checks in the knowledge base module

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enf…

    zammad zammad
  • High 7.1
    CVE-2026-56727

    Zammad: PGP signature spoofing via unvalidated verification return

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or…

    zammad zammad
  • Medium 5.3
    CVE-2026-56728

    Zammad: Cross-User Taskbar Item Access Control Vulnerability

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with t…

    zammad zammad
  • Medium 5.3
    CVE-2026-56732

    Zammad: Malicious input in Ticket Body Enables Session Termination

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can…

    zammad zammad
  • Medium 5.3
    CVE-2026-56734

    Zammad: Avatar Image URL Server-Side Request Forwarding

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who contro…

    zammad zammad
  • Medium 5.3
    CVE-2026-56735

    Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not su…

    zammad zammad
  • Medium 5.1
    CVE-2026-56726

    Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, st…

    zammad zammad
  • Low 2.1
    CVE-2026-56729

    Zammad: Titles of knowledge base answers will be shown across all categories via the global search

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from catego…

    zammad zammad
  • Low 2.1
    CVE-2026-56730

    Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable Grap…

    zammad zammad

Revision history

  1. #4

    Referenz(en) aufgenommen: CVE-2026-56732, EUVD-2026-87219, CVE-2026-56724, EUVD-2026-87203, CVE-2026-56723, EUVD-2026-87205, CVE-2026-56729, EUVD-2026-87208, CVE-2026-56726, EUVD-2026-87212, CVE-2026-56734, EUVD-2026-87213, CVE-2026-56727, EUVD-2026-87214, CVE-2026-56735, EUVD-2026-87215, CVE-2026-56731, EUVD-2026-87216, CVE-2026-56728, EUVD-2026-87221, CVE-2026-56725, EUVD-2026-87220, CVE-2026-56733, EUVD-2026-87217, CVE-2026-56730, EUVD-2026-87218

  2. #3

    Referenz(en) aufgenommen: EUVD-2026-52856

  3. #2

    Referenz(en) aufgenommen: CVE-2026-13229, GHSA-32GV-72X5-3983

  4. #1

    Initiale Fassung

References