Executive brief
Zammad is an open-source helpdesk and customer support platform used by businesses to manage client communications. A security flaw in the ticket creation process allowed users to bypass standard authorization checks when specific parameters were used. This could allow unauthorized individuals to create or link tickets, potentially leading to unauthorized data modification or disruption of support workflows.
Technical details
A missing authorization vulnerability (CWE-862) exists in Zammad's ticket creation endpoint. When a request includes specific parameters for adding links, the system fails to validate the user's permissions before processing the action. This allows a remote attacker to perform unauthorized ticket-related actions over the network without requiring special privileges or user interaction. The vulnerability affects versions prior to 6.5.4 and the 7.0.0-alpha branch. It has been addressed in versions 6.5.4 and 7.0.1 by improving permission checks on the affected endpoint.
Affected products
- Zammad Zammad < 6.5.4, >= 7.0.0-alpha, < 7.0.1
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched