CVE-2026-56728 Details
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. The taskbar feature stores transient state for active user sessions, including auto-saved ticket drafts. Under certain conditions, the authorization check for taskbar item access is not enforced, allowing a user to read another user's taskbar item data. This vulnerability is fixed in 7.0.2.
A broken access control vulnerability has been identified in Zammad's GraphQL API, affecting versions through 7.0.0. This vulnerability allows an authenticated user to access taskbar item data of another user by sending a request that includes the target user's taskbar identifier. The taskbar feature holds temporary data for active user sessions, such as auto-saved ticket drafts. The vulnerability arises because, under certain conditions, the authorization check for accessing taskbar items is not properly enforced, enabling users to read taskbar data belonging to others.
Users can upgrade to Zammad version 7.0.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zammad/zammad/commit/4ccd5d573023b66b0d0184914c92417e1780793f | [email protected] | Source CodeVendor |
| https://github.com/zammad/zammad/releases/tag/7.0.2 | [email protected] | Release NotesVendor |
| https://github.com/zammad/zammad/security/advisories/GHSA-jvcg-5539-vvc3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zammad | <= 7.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |