Read the docs
TI-2026-40899 Aliases CVE-2026-56726

Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

Priority LOW 23CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed zammad (zammad): 7.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Zammad GmbHzammadbefore 7.0.27.0.2Patch availableCNA
  • zammad VendorZammad GmbH Affected before 7.0.2 Fixed in 7.0.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*——Zammad GmbH
  • cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* Versions — — ·Zammad GmbH

Remediation

  • Fix · CNA zammad (zammad) Fixed in 7.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56726

References

Other 4

  • TI-2026-65406 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-65405 Undisclosed RCE in Zammad v6.3 and higher KEVCVSS 4.0CRITICAL 9.4
  • TI-2024-22252 An issue was discovered in Zammad before 6.3.0. CVSS 3.1CRITICAL 9.1
  • TI-2026-11233 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning CVSS 4.0HIGH 7.1
  • TI-2022-23785 A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate… CVSS 3.1CRITICAL 9.8
  • TI-2026-58043 Zammad: Account takeover via unverified email matching during SSO auto-link CVSS 4.0CRITICAL 9.1
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences