Read the docs
TI-2026-46907 Aliases CVE-2026-65828

Zammad: Pending upload deletion bypass via legacy attachment endpoint

Priority LOW 11CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed zammad (zammad): 7.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Zammad GmbHzammadbefore 7.1.27.1.2Patch availableCNA
  • zammad VendorZammad GmbH Affected before 7.1.2 Fixed in 7.1.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*——Zammad GmbH
  • cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* Versions — — ·Zammad GmbH

Remediation

  • Fix · CNA zammad (zammad) Fixed in 7.1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65828

References

Other 2

  • TI-2026-65406 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-65405 Undisclosed RCE in Zammad v6.3 and higher KEVCVSS 4.0CRITICAL 9.4
  • TI-2024-22252 An issue was discovered in Zammad before 6.3.0. CVSS 3.1CRITICAL 9.1
  • TI-2026-11233 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning CVSS 4.0HIGH 7.1
  • TI-2022-23785 A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate… CVSS 3.1CRITICAL 9.8
  • TI-2026-58043 Zammad: Account takeover via unverified email matching during SSO auto-link CVSS 4.0CRITICAL 9.1
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences