PT-2026-99087

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Zammad is a web-based open source helpdesk and customer support system. A flaw in the two-factor login process allows an attacker to perform unlimited password guesses for any account. This occurs...

PT-2026-98939

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An unauthenticated remote attacker can cause a denial of service on a production instance. This occurs because the import check and import status actions lack the setup done response guard, allowing...

CVE-2026-56725: Missing Authentication for Critical Function

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/importcheck blocks a Zammad request worker for roughly two minutes. The importcheck and importstatus actions are missing the setupdoneresponse guard...

CVE-2026-84461: Observable Discrepancy

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even...

PT-2026-99090

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Zammad fails to properly verify the trust of signing certificates when processing incoming S/MIME-signed emails. Instead of validating the certificate chain, the system only checks if a certificate wi...

CVE-2026-63208: Improper Encoding or Escaping of Output

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

PT-2026-98948

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description During federated authentication OAuth, OIDC, or SAML, the system fetches a profile image URL from an external identity provider without verifying the target address. An actor with control over their...

PT-2026-99089

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The External Data Source feature, which retrieves records from external systems, fails to properly verify user permissions before including record details in requests. An authenticated user with basic...

PT-2026-98946

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description Zammad is a web-based open source helpdesk and customer support system. A flaw in the HTML sanitization process allows the injection of specific HTML elements into ticket bodies. When a user views a...

CVE-2026-65828: Missing Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroyform action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied formid without verifying that the requesting user owns those records. An authenticated...

PT-2026-98947

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Zammad versions prior to 7.1.0 Description Zammad is a web-based open source helpdesk and customer support system. The issue involves a lack of discursive validation within the authorization cascade, where...

PT-2026-98940

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An issue in the ticket isolation mechanism allows any authenticated agent to bypass boundaries and view sensitive data from GitHub or GitLab issues attached to any ticket in the system. By querying...

PT-2026-99085

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When the "Automatic account link on initial logon" setting is enabled, the system binds an incoming third-party Single Sign-On SSO identity to an existing local account by matching the reported email...

PT-2026-99083

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When a Microsoft Graph request fails, the system logs the error including the authentication token used to access the mailbox. Although the system attempts to mask the token, the process is incomplete...

CVE-2026-61855: Improper Verification of Cryptographic Signature

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

PT-2026-98950

Name of the Vulnerable Software and Affected Versions Zammad version 7.0.2 Zammad version 7.1.0 Description Session management for websocket and long-polling connections is susceptible to a path traversal attack, which occurs when an application uses user-controllable input to construct a path to...

CVE-2026-61525: Improper Limitation of a Pathname to a Restricted Directory

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

PT-2026-98949

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Zammad versions prior to 7.1.0 Description The HTML sanitizer HtmlSanitizer::Strict fails to block external URLs within the srcset attribute of tags. While other external URLs are blocked to prevent remote conten...

PT-2026-98944

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An authorization bypass allows an authenticated agent to read knowledge base answer content without proper authorization. The issue exists in a GraphQL mutation used to transform knowledge base answer...

PT-2026-99084

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Unsanitized option labels are rendered as raw HTML without escaping in the configuration dialogs of AI Agents within the admin UI. An attacker can inject arbitrary HTML and JavaScript by controlling a...