Skip to content
OpenAdvisories
High WID-SEC-2026-2641 18 CVEs

Zammad: Mehrere Schwachstellen

Published Aug 3, 2026 · Updated Nov 4, 2026 · Revision 4 · de-DE

Vendor: zammad Product: zammad

Summary

Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder sich unbefugten Zugriff auf bestehende Benutzerkonten zu verschaffen, einschließlich Agenten- und Administratorkonten.

Product

Zammad ist ein Helpdesk- und Ticketsystem.

Vulnerabilities 18

  • Critical 9.1
    CVE-2026-84458

    Zammad: Account takeover via unverified email matching during SSO auto-link

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email a…

    zammad zammad
  • High 8.6
    CVE-2026-84462

    Zammad: AI Agent template sanitizer bypass leads to remote code execution

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with perm…

    zammad zammad
  • High 7.1
    CVE-2026-13229

    Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

    Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.

    zammad zammad
  • High 7.1
    CVE-2026-84464

    Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, grou…

    zammad zammad
  • High 7.1
    CVE-2026-84465

    Zammad: S/MIME signature verification allows forged sender impersonation

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a cer…

    zammad zammad
  • Medium 6.9
    CVE-2026-63207

    Zammad: Sensitive Information Exposure in Integration Administration API

    Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mas…

    zammad zammad
  • Medium 6.9
    CVE-2026-84461

    Zammad: Missing rate limiting allows password brute-forcing during two-factor login

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also reveale…

    zammad zammad
  • Medium 6.3
    CVE-2026-84463

    Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value…

    zammad zammad
  • Medium 5.3
    CVE-2026-61855

    Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

    Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid ("Good") PGP signature from a registered sender key, eve…

    zammad zammad
  • Medium 5.3
    CVE-2026-63006

    Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the b…

    zammad zammad
  • Medium 5.3
    CVE-2026-63206

    Zammad: Remote image tracking bypass via shortened URL scheme

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the sche…

    zammad zammad
  • Medium 5.3
    CVE-2026-63216

    Zammad: Stored XSS via unescaped option labels in the object attribute options context UI

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is out…

    zammad zammad
  • Medium 5.3
    CVE-2026-84460

    Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket.…

    zammad zammad
  • Medium 5.1
    CVE-2026-102345

    Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpr…

    zammad zammad
  • Medium 5.1
    CVE-2026-63205

    Zammad: Channel admins can read unauthorized attachments via signature rich-text body

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any exi…

    zammad zammad
  • Medium 5.1
    CVE-2026-63208

    Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, b…

    zammad zammad
  • Low 2.3
    CVE-2026-63204

    Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message sto…

    zammad zammad
  • Low 2.3
    CVE-2026-65828

    Zammad: Pending upload deletion bypass via legacy attachment endpoint

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user ow…

    zammad zammad

Revision history

  1. #4

    Referenz(en) aufgenommen: CVE-2026-102345, EUVD-2026-117049

  2. #3

    Referenz(en) aufgenommen: CVE-2026-84465, EUVD-2026-87265, CVE-2026-84463, EUVD-2026-87264, CVE-2026-84464, EUVD-2026-87263, CVE-2026-84458, EUVD-2026-87261, CVE-2026-84461, EUVD-2026-87267, CVE-2026-84460, EUVD-2026-87259, CVE-2026-84462, EUVD-2026-87245, EUVD-2026-87224, EUVD-2026-87262, EUVD-2026-87270, EUVD-2026-87266, EUVD-2026-87258, EUVD-2026-87257, EUVD-2026-87268, EUVD-2026-87271, EUVD-2026-87269

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-52856

  4. #1

    Initiale Fassung

References