CVE-2026-56728

🗓️ 25 Sep 2026 17:10:16Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

Authenticated users can read other users' taskbar item data in Zammad prior to 7.0.2.

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2026-56728 Zammad: Cross-User Taskbar Item Access Control Vulnerability	25 Sep 202617:10	–	cvelist
EUVD	EUVD-2026-87221	25 Sep 202617:10	–	euvd
NVD	CVE-2026-56728	25 Sep 202618:17	–	nvd
osv_cve	CVE-2026-56728 Zammad: Cross-User Taskbar Item Access Control Vulnerability	25 Sep 202617:10	–	osv_cve
Positive Technologies	PT-2026-98942	25 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-56728: Exposure of Sensitive Information to an Unauthorized Actor	25 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-56728 Zammad: Cross-User Taskbar Item Access Control Vulnerability	25 Sep 202617:10	–	vulnrichment

Vulners

Node

zammad zammadRange<7.0.2

[
  {
    "vendor": "zammad",
    "product": "zammad",
    "versions": [
      {
        "version": "< 7.0.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/zammad/zammad/commit/4ccd5d573023b66b0d0184914c92417e1780793f
github	www.github.com/zammad/zammad/releases/tag/7.0.2
github	www.github.com/zammad/zammad/security/advisories/GHSA-jvcg-5539-vvc3

Parameter	Position	Path	Description	CWE
graphql	request body	/graphql	Broken access control in the GraphQL API allows an authenticated user to access taskbar item data belonging to another user by providing the target user's taskbar identifier.	CWE-200, CWE-639

28 Sep 2026 14:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 45.3

EPSS0.0033

SSVC