6 matches found
CVE-2026-63204
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...
CVE-2026-63204 Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...
CVE-2026-63204
In Zammad versions prior to 7.1.2 , an authenticated user with agent permissions can exploit a vulnerability in the ticket summarize endpoint . By supplying an arbitrary AI analytics run identifier , an attacker can retrieve the AI provider error message associated with that run. This allows the ...
CVE-2026-63204 Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...
CVE-2026-63204: Authorization Bypass Through User-Controlled Key
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...
PT-2026-99079
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An authenticated user with agent permissions can provide an arbitrary AI analytics run identifier to the ticket summarize endpoint. This allows the user to retrieve the AI provider error message...