CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

EUVD-2026-87264

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-84463

The Zammad helpdesk system is vulnerable to stored HTML injection in the Knowledge Base video widget prior to version 7.1.2 . An attacker with Knowledge Base editing rights can embed a specially crafted value in a published answer. Because the system fails to escape this value for its attribute c...

CVE-2026-56730

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

CVE-2026-56724

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-56730 Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

EUVD-2026-87218

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

CVE-2026-56730 Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

CVE-2026-56730 Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

CVE-2026-56730

The open-source helpdesk system Zammad is vulnerable to an authorization bypass in versions prior to 7.0.2 . The flaw exists within a GraphQL mutation designed to transform knowledge base answer suggestions for the ticket editor. While the system verifies if a user has the ticket.agent permission...

CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-56724

The web-based open source helpdesk system Zammad is vulnerable to a permission check flaw in the knowledge base management area prior to version 7.0.2 . Due to incomplete data validation for linked items, users with limited read permissions could potentially interact with items outside their assi...

EUVD-2026-87203

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

PT-2026-99088

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Users with Knowledge Base editing rights for a category can embed a video widget in a published answer using a specially crafted value. Because this value is inserted into the page HTML without being...

PT-2026-99076

Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected...

PT-2026-98899

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An issue with permission checks in the knowledge base management area allows users with limited read permissions to interact with items outside their assigned access scope due to incomplete data...