Read the docs
TI-2026-40901 Aliases CVE-2026-56728

Zammad: Cross-User Taskbar Item Access Control Vulnerability

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-639.

Summary

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. The taskbar feature stores transient state for active user sessions, including auto-saved ticket drafts. Under certain conditions, the authorization check for taskbar item access is not enforced, allowing a user to read another user's taskbar item data. This vulnerability is fixed in 7.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Fixed zammad (zammad): 7.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Zammad GmbHzammadbefore 7.0.27.0.2Patch availableCNA
  • zammad VendorZammad GmbH Affected before 7.0.2 Fixed in 7.0.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*——Zammad GmbH
  • cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* Versions — — ·Zammad GmbH

Remediation

  • Fix · CNA zammad (zammad) Fixed in 7.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56728

References

Other 3

  • TI-2026-65406 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-65405 Undisclosed RCE in Zammad v6.3 and higher KEVCVSS 4.0CRITICAL 9.4
  • TI-2024-22252 An issue was discovered in Zammad before 6.3.0. CVSS 3.1CRITICAL 9.1
  • TI-2026-11233 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning CVSS 4.0HIGH 7.1
  • TI-2022-23785 A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate… CVSS 3.1CRITICAL 9.8
  • TI-2026-58043 Zammad: Account takeover via unverified email matching during SSO auto-link CVSS 4.0CRITICAL 9.1
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences