Priority CRITICAL 100KEV
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the…
CVSS 4.0CRITICAL 9.4· Network · No auth · User interaction · EPSS 0.10936 · Published 2026-09-30 · Fixed in 7.2.2 CWE-269
Priority CRITICAL 100KEV
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.
CVSS 4.0CRITICAL 9.4· Network · No auth · User interaction · EPSS 0.49915 · Published 2026-09-30 · Fixed in 6.5.4 CWE-384
Priority HIGH 80
An issue was discovered in Zammad before 6.3.0.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00448 · Published 2024-04-26 · No fix listed CWE-639
Priority MEDIUM 64
Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00427 · Published 2026-08-04 · No fix listed CWE-862
Priority MEDIUM 51
A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00879 · Published 2023-02-03 · No fix listed
Priority MEDIUM 47
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00356 · Published 2026-09-25 · Fixed in 7.1.2 CWE-287
Priority MEDIUM 47
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02329 · Published 2021-10-07 · No fix listed CWE-502
Priority MEDIUM 46
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00356 · Published 2026-09-25 · No fix listed CWE-22
Priority MEDIUM 46
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00412 · Published 2026-09-25 · Fixed in 7.0.2 CWE-306
Priority MEDIUM 46
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01887 · Published 2021-10-07 · No fix listed CWE-77
Priority MEDIUM 45
An issue was discovered in Zammad before 3.4.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0135 · Published 2020-12-28 · No fix listed CWE-287
Priority MEDIUM 45
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01545 · Published 2017-03-13 · No fix listed CWE-287
Priority MEDIUM 44
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00451 · Published 2026-04-08 · Fixed in 6.5.4, 7.0.1 CWE-284
Priority MEDIUM 44
Zammad 5.2.0 is vulnerable to privilege escalation.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00911 · Published 2022-08-08 · No fix listed CWE-307
Priority MEDIUM 43
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00727 · Published 2017-03-13 · No fix listed CWE-352
Priority MEDIUM 41
An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01088 · Published 2022-04-27 · No fix listed CWE-306
Priority MEDIUM 41
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01076 · Published 2021-10-07 · No fix listed CWE-918
Priority MEDIUM 40
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.7· Network · High privileges · User interaction · EPSS 0.00319 · Published 2026-04-08 · Fixed in 7.0.1 CWE-1336
Priority MEDIUM 40
An issue was discovered in Zammad before 6.2.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00701 · Published 2023-12-10 · No fix listed CWE-770
Priority MEDIUM 40
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01114 · Published 2021-10-07 · No fix listed
Priority LOW 39
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00277 · Published 2026-09-25 · Fixed in 7.1.2 CWE-1336
Priority LOW 39
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00267 · Published 2026-09-25 · Fixed in 7.0.2 CWE-269
Priority LOW 39
A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00585 · Published 2017-03-13 · No fix listed CWE-352
Priority LOW 38
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.4· Network · Low privileges · User interaction · EPSS 0.00243 · Published 2026-09-25 · Fixed in 7.0.1 CWE-79
Priority LOW 38
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2025-04-05 · Fixed in 6.4.2 CWE-602
Load more
THREATIST.IORead the docs