PT-2026-99081

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The HTML sanitizer used in ticket articles and email views fails to correctly identify and block remote images when a shortened URL format is used that omits the double slash after the scheme. Because...

PT-2026-99080

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When creating or updating an email signature, the system processes inline images in the signature body. If an HTML img tag points to an existing attachment, the system copies that attachment into a ne...

PT-2026-99086

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An issue exists where any authenticated user can access the REST endpoint used to retrieve tag lists. This allows the user to obtain tag names for a specific ticket even if they lack the necessary...

PT-2026-98958

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description A security filter protecting the AI Agent configuration can be bypassed by entering specially crafted text into an AI Agent field. An administrator with permissions to create or edit AI Agents can...

PT-2026-98945

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 Description An authenticated user with low privileges can inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title during the standard ticket creation process. This occurs because th...

PT-2026-98943

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description In the global quick search, a user assigned the knowledge base.editor role in one knowledge base category can view answer titles and updated at timestamps from other categories for which they lack...

PT-2026-98938

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An authorization bypass exists where a customer with access to a ticket can download attachments from internal ticket articles. While the article listing API correctly hides internal articles, the...

PT-2026-99078

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An issue exists where attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browse...

CVE-2026-84464: Exposure of Sensitive Information to an Unauthorized Actor

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-63204: Authorization Bypass Through User-Controlled Key

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...

CVE-2026-13229

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

CVE-2026-13229

Affected product/versions: Zammad 7.1.0 (ticket article attachment cloning endpoint).Root cause: authenticated improper authorization in the endpoint, enabling actions beyond the intended permissions.Impact: confidentiality impact HIGH per CVSS metrics; exploitation could arise from network-acces...

CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

CVE-2026-13229

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

EUVD-2026-52856

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

PT-2026-67808

Name of the Vulnerable Software and Affected Versions Zammad version 7.1.0 Description An authenticated improper authorization issue exists in the ticket article attachment cloning endpoint. Improper authorization occurs when a system fails to properly verify if a user has the necessary permissio...

CVE-2026-13229: Missing Authorization

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

Zammad Helpdesk Panel - Detect

Zammad is an open source helpdesk and customer support system that provides ticket management, live chat, and knowledge base functionality. This template detects exposed Zammad installations. !/usr/bin/env python3 -- coding: utf-8 -- """Zammad is an open source helpdesk and customer support syste...