CVE-2026-65828 Details
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2.
A vulnerability exists in Zammad versions through 7.1.1 within the AttachmentsController's legacy destroy_form action. This vulnerability allows an authenticated attacker to delete another user's temporary file uploads. The issue arises because the action removes UploadCache Store records based solely on a user-provided form_id, without verifying ownership of those records. An attacker who obtains another user's pending-upload UUID can exploit this flaw, silently erasing uploads before the user submits their ticket or article.
Users can upgrade to Zammad version 7.1.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zammad/zammad/commit/3b755736fdbee8ff6ddf53661d6912d3d3028325 | [email protected] | Source CodeVendor |
| https://github.com/zammad/zammad/security/advisories/GHSA-x4f3-367g-m93g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zammad | <= 7.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |