High · 7.1 CVE-2026-13229 EUVD-2026-52856

Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

Published Aug 4, 2026 · Updated Aug 7, 2026 · Assigned by Fluid Attacks

Vendor: zammad Product: zammad

Description

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.

Affected products

Vendor	Product	Affected	Fixed
Zammad	Zammad	≤ 7.0.1	—

Advisories 2

WID-SEC-2026-2641 Zammad: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
WID-SEC-2026-1981 Zammad: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2026

References

https://fluidattacks.com/es/advisories/chicago third-party-advisory
https://github.com/zammad/zammad/security/advisories/GHSA-374g-4f73-g7m7 vendor-advisory
https://github.com/zammad/zammad/releases/tag/7.1.2 patch
https://github.com/zammad/zammad product