Read the docs
TI-2026-40897 Aliases CVE-2026-56724

Zammad: Incorrect implementation of permission checks in the knowledge base module

Priority LOW 31CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users with limited read permissions to interact with items outside their assigned access scope. Data access has been strengthened in the current version through additional validation routines. This issue is fixed in version 7.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Fix Fixed zammad (zammad): 7.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Zammad GmbHzammadbefore 7.0.27.0.2Patch availableCNA
  • zammad VendorZammad GmbH Affected before 7.0.2 Fixed in 7.0.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*——Zammad GmbH
  • cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* Versions — — ·Zammad GmbH

Remediation

  • Fix · CNA zammad (zammad) Fixed in 7.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56724

References

Other 3

  • TI-2026-65406 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-65405 Undisclosed RCE in Zammad v6.3 and higher KEVCVSS 4.0CRITICAL 9.4
  • TI-2024-22252 An issue was discovered in Zammad before 6.3.0. CVSS 3.1CRITICAL 9.1
  • TI-2026-11233 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning CVSS 4.0HIGH 7.1
  • TI-2022-23785 A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate… CVSS 3.1CRITICAL 9.8
  • TI-2026-58043 Zammad: Account takeover via unverified email matching during SSO auto-link CVSS 4.0CRITICAL 9.1
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences