CVE-2026-84460 Details
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2.
A vulnerability exists in Zammad versions prior to 7.1.2, where any authenticated user can access the REST endpoint for retrieving tag lists. This access is granted regardless of the user's permissions related to specific tickets. Tags, which may contain sensitive information, can be enumerated in bulk due to the sequential nature of ticket IDs. The issue has been addressed in Zammad version 7.1.2.
Users can upgrade to Zammad version 7.1.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zammad/zammad/commit/13217eb6b3fdf350228b13f8cf69f640b8fd0da2 | [email protected] | Source CodeVendor |
| https://github.com/zammad/zammad/commit/d1a5eabdd1285b202f75761c4406edc5509e217e | [email protected] | Source CodeVendor |
| https://github.com/zammad/zammad/security/advisories/GHSA-6vgm-xxp4-p6jv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zammad | <= 7.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 29, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |