Priority CRITICAL 100KEV
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the…
CVSS 4.0CRITICAL 9.4· Network · No auth · User interaction · EPSS 0.10936 · Published 2026-09-30 · Fixed in 7.2.2 CWE-269
Priority CRITICAL 100KEV
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.
CVSS 4.0CRITICAL 9.4· Network · No auth · User interaction · EPSS 0.49915 · Published 2026-09-30 · Fixed in 6.5.4 CWE-384
Priority HIGH 80
An issue was discovered in Zammad before 6.3.0.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00448 · Published 2024-04-26 · No fix listed CWE-639
Priority MEDIUM 51
A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00879 · Published 2023-02-03 · No fix listed
Priority MEDIUM 47
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02329 · Published 2021-10-07 · No fix listed CWE-502
Priority MEDIUM 46
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01887 · Published 2021-10-07 · No fix listed CWE-77
Priority MEDIUM 45
An issue was discovered in Zammad before 3.4.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0135 · Published 2020-12-28 · No fix listed CWE-287
Priority MEDIUM 45
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01545 · Published 2017-03-13 · No fix listed CWE-287
Priority MEDIUM 44
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00451 · Published 2026-04-08 · Fixed in 6.5.4, 7.0.1 CWE-284
Priority MEDIUM 44
Zammad 5.2.0 is vulnerable to privilege escalation.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00911 · Published 2022-08-08 · No fix listed CWE-307
Priority MEDIUM 43
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00727 · Published 2017-03-13 · No fix listed CWE-352
Priority MEDIUM 41
An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01088 · Published 2022-04-27 · No fix listed CWE-306
Priority MEDIUM 41
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01076 · Published 2021-10-07 · No fix listed CWE-918
Priority MEDIUM 40
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.7· Network · High privileges · User interaction · EPSS 0.00319 · Published 2026-04-08 · Fixed in 7.0.1 CWE-1336
Priority MEDIUM 40
An issue was discovered in Zammad before 6.2.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00701 · Published 2023-12-10 · No fix listed CWE-770
Priority MEDIUM 40
An issue was discovered in Zammad before 4.1.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01114 · Published 2021-10-07 · No fix listed
Priority LOW 39
A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00585 · Published 2017-03-13 · No fix listed CWE-352
Priority LOW 38
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2025-04-05 · Fixed in 6.4.2 CWE-602
Priority LOW 38
An issue was discovered in Zammad before 6.3.0.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00511 · Published 2024-04-26 · No fix listed CWE-284
Priority LOW 37
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00952 · Published 2022-02-04 · No fix listed
Priority LOW 36
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00174 · Published 2026-04-08 · Fixed in 6.5.4, 7.0.1 CWE-862
Priority LOW 36
Zammad is a web based open source helpdesk/customer support system.
CVSS 4.0HIGH 8.3· Network · High privileges · No interaction · EPSS 0.00254 · Published 2026-04-08 · Fixed in 6.5.4, 7.0.1 CWE-918
Priority LOW 35
In Zammad 6.4.x before 6.4.2, there is information exposure.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00258 · Published 2025-04-05 · Fixed in 6.4.2 CWE-402
Priority LOW 35
An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00425 · Published 2023-05-18 · No fix listed CWE-863
Priority LOW 35
In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which wou…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.009 · Published 2022-08-08 · No fix listed
Load more
THREATIST.IORead the docs