Is CVE-2026-34782 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34782 being exploited in the wild.

How severe is CVE-2026-34782?

Medium severity, with a CVSS score of 4.3, published 8 April 2026.

Which products and versions are affected?

Zammad >= 7.0.0, < 7.0.1; < 6.5.4.

Is there a fix for CVE-2026-34782?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34782 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-34782?

Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34782: Zammad missing authorization in AI assistance text tools

Q: Which products and versions are affected?

Zammad >= 7.0.0, < 7.0.1; < 6.5.4.

Q: Is there a fix for CVE-2026-34782?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34782 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-34782?

Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34782 · Severity: medium · CVSS 4.3 · Published 2026-04-08

Zammad is an open-source customer support and helpdesk platform. A security flaw was identified where the system failed to verify if a user had the necessary permissions to use AI-powered text tools. This could allow unauthorized users to access and use these AI features in contexts where they should be restricted, potentially leading to unauthorized data processing or increased operational costs.

Technologies: Zammad. Vendors: Zammad.

Quick answers

Is CVE-2026-34782 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34782 being exploited in the wild.
How severe is CVE-2026-34782?: Medium severity, with a CVSS score of 4.3, published 8 April 2026.
Which products and versions are affected?: Zammad >= 7.0.0, < 7.0.1; < 6.5.4.
Is there a fix for CVE-2026-34782?: A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34782 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-34782?: Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the Zammad AI assistance controller. The REST endpoint 'POST /api/v1/ai_assistance/text_tools/:id' failed to perform an authorization check to ensure the requesting user possessed the required 'ticket.agent' permission. An authenticated attacker with low privileges can exploit this over the network to utilize AI text tools in unauthorized situations. The vulnerability is resolved in versions 7.0.1 and 6.5.4 by implementing the necessary permission checks.

Affected products

Zammad Zammad >= 7.0.0, < 7.0.1; < 6.5.4

Timeline

2026-04-08: disclosed
2026-04-08: advisory
2026-04-08: patched

References

https://github.com/zammad/zammad/security/advisories/GHSA-96r7-29c8-2j7q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.