Vendor
zammad
49 known vulnerabilities.
zammad at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 32 | 3 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 10 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 4 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
High max 9.1
Zammad: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder sich unbefugten Zu…
first Aug 3, 2026 -
Critical max 9.4
Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und Privilegieneskalation
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen und um Root-Rechte zu erlangen.
first Sep 30, 2026 -
Medium max 9.4
Zammad: Schwachstelle ermöglicht Privilegienerweiterung
Ein lokaler Angreifer kann eine Schwachstelle in Zammad ausnutzen, um seine Privilegien zu erweitern
-
HighWID-SEC-2026-3753 0 CVEs
Zammad: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen.
-
Critical max 9.4
Kwetsbaarheden aangetroffen in Zammad
Er zijn twee zeroday-kwetsbaarheden aangetroffen in Zammad.
49 results · Feed
-
Medium 5.1
Zammad: Stored XSS in ticket article rendering in the new Vue-based interface
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpr…
-
Critical 9.4
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running a…
KEV Oct 2, 2026 -
Critical 9.4
Undisclosed RCE in Zammad v6.3 and higher
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
KEV Oct 2, 2026 -
Medium 5.1
Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, b…
-
Medium 5.3
Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the b…
-
Low 2.3
Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message sto…
-
Medium 5.3
Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid ("Good") PGP signature from a registered sender key, eve…
-
Medium 6.9
Zammad: Missing rate limiting allows password brute-forcing during two-factor login
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also reveale…
-
Medium 6.9
Zammad: Sensitive Information Exposure in Integration Administration API
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mas…
-
High 7.1
Zammad: S/MIME signature verification allows forged sender impersonation
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a cer…
-
Medium 6.3
Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value…
-
High 7.1
Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, grou…
-
Medium 5.3
Zammad: Stored XSS via unescaped option labels in the object attribute options context UI
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is out…
-
Critical 9.1
Zammad: Account takeover via unverified email matching during SSO auto-link
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email a…
-
Medium 5.3
Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket.…
-
Medium 5.3
Zammad: Remote image tracking bypass via shortened URL scheme
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the sche…
-
Medium 5.1
Zammad: Channel admins can read unauthorized attachments via signature rich-text body
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any exi…
-
High 8.6
Zammad: AI Agent template sanitizer bypass leads to remote code execution
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with perm…
-
Low 2.3
Zammad: Pending upload deletion bypass via legacy attachment endpoint
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user ow…
-
High 8.8
Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller
Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficie…
-
Medium 5.3
Zammad: Cross-User Taskbar Item Access Control Vulnerability
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with t…
-
High 8.7
Zammad: Denial of Service via OTRS Import Controller
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions …
-
Medium 5.3
Zammad: Malicious input in Ticket Body Enables Session Termination
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can…
-
Low 2.1
Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable Grap…
-
High 8.7
Zammad: Incorrect Authorization and Improper Privilege Management
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions…
-
High 8.4
Zammad: Cross-Site Scripting in Ticket Notifications
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The ti…
-
Medium 5.3
Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not su…
-
High 7.1
Zammad: PGP signature spoofing via unvalidated verification return
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or…
-
Medium 5.3
Zammad: Avatar Image URL Server-Side Request Forwarding
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who contro…
-
Medium 5.1
Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, st…
-
Low 2.1
Zammad: Titles of knowledge base answers will be shown across all categories via the global search
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from catego…
-
High 7.1
Zammad: Missing authorization on ticket attachment download
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging t…
-
High 7.1
Zammad: Incorrect implementation of permission checks in the knowledge base module
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enf…
-
High 7.1
Zammad 7.0.1 - Improper authorization in ticket article attachment cloning
Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.
-
Medium 5.3
Zammad is miissing authorization in AI assistance controller for context data used in text tools
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt…
-
Medium 5.3
Zammad has improper access control in AI assistance controller for text tools
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all s…
-
High 8.7CVE-2026-34724 Public exploit
Zammad has a server-side template injection leading to RCE via AI Agent
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrich…
-
High 8.7
Zammad has incorrect access control in getting_started_controller
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was co…
-
Medium 6.9
Zammad is missing authorization in ticket create endpoint
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.
-
Medium 5.9
Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 an…