CVE-2022-40816

Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be...

CVE-2022-40816

Zammad 5.2.1 is affected by an Incorrect Access Control flaw where the asset handling logic fails over WebSocket connections, allowing an authenticated attacker to query the Zammad API and fetch other users’ personal data. The issue manifests when access control checks are bypassed through the we...