zammad

49 results · Feed

• Low 2.3
  CVE-2026-34720

  Zammad has an origin validation error in SSO mechanism

  Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fix…

  zammad zammad
  Apr 8, 2026
• High 8.3
  CVE-2026-34719

  Zammad has a Server-side request forgery (SSRF) via webhooks

  Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was che…

  zammad zammad
  Apr 8, 2026
• Medium 5.3
  CVE-2026-34718

  Zammad improperly neutralizes of script-related HTML tags in ticket articles

  Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Z…

  zammad zammad
  Apr 8, 2026
• Low 2.1
  CVE-2026-34248

  Zammad has an information disclosure in ticket detail view of customers in shared organizations

  Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at a…

  zammad zammad
  Apr 8, 2026
• Medium 4.2
  CVE-2025-32360

  In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared artic…

  zammad zammad
  Apr 5, 2025
• Medium 4.3
  CVE-2025-32357

  In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to …

  zammad zammad
  Apr 5, 2025
• Medium 4.8
  CVE-2025-32359

  In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor …

  zammad zammad
  Apr 5, 2025
• Medium 4.0
  CVE-2025-32358

  In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are trigge…

  zammad zammad
  Apr 5, 2025
• Unscored —
  CVE-2019-1010018

  Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java s…

  zammad zammad
  Jul 16, 2019