CVE-2026-63006: Improper Limitation of a Pathname to a Restricted Directory

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-56724: Authorization Bypass Through User-Controlled Key

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-84462: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents cou...

CVE-2026-56731: Improper Neutralization of Input During Web Page Generation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-56733: Improper Privilege Management

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new...

CVE-2026-56734: Server-Side Request Forgery (SSRF)

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56732: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating...

CVE-2026-56730: Missing Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

CVE-2026-56727: Improper Authentication

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-56726: Missing Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-56729: Exposure of Sensitive Information to an Unauthorized Actor

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledgebase.editor in one category can see answer titles and updatedat timestamps from categories they do not have editor access to ,...

CVE-2026-56723: Incorrect Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

CVE-2026-63206: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-56735: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

PT-2026-99079

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An authenticated user with agent permissions can provide an arbitrary AI analytics run identifier to the ticket summarize endpoint. This allows the user to retrieve the AI provider error message...

PT-2026-99088

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Users with Knowledge Base editing rights for a category can embed a video widget in a published answer using a specially crafted value. Because this value is inserted into the page HTML without being...

PT-2026-99082

Name of the Vulnerable Software and Affected Versions Zammad versions 7.0.3 through 7.1.1 Description An authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. The system fails to consistently mask sensitive fields in certain...

PT-2026-98941

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description In the inbound PGP email processing, the return value of the gpg verification call is silently discarded. The handler unconditionally marks the security preferences of the article as having a successf...

CVE-2026-56728: Exposure of Sensitive Information to an Unauthorized Actor

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. T...

PT-2026-98942

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description Broken access control in the GraphQL API allows an authenticated user to access taskbar item data belonging to another user. By crafting a request with the target user's taskbar identifier, an attacke...