CVE-2026-84464 Details
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including its details in a request to that external system. An authenticated user, including one with only basic customer access, could exploit this by referencing another record's ID, and thereby view details of tickets, customer accounts, teams, or organizations that did not belong to them. This issue is fixed in version 7.1.2.
A vulnerability exists in Zammad's External Data Source feature, prior to version 7.1.2, which improperly verifies user permissions before sending requests to external systems. This flaw allows authenticated users, including those with basic customer access, to access details of tickets, users, groups, or organizations that do not belong to them by referencing the IDs of those records. The issue has been fixed in version 7.1.2.
Users can upgrade to Zammad version 7.1.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zammad/zammad/commit/34bdf46273adbea03821ac7157c8beaacde03a4b | [email protected] | Source CodeVendor |
| https://github.com/zammad/zammad/security/advisories/GHSA-jvm2-cr58-4qxp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zammad | <= 7.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | New CVE Received | [email protected] |
| Sep 25, 2026 | CVE Modified | CISA-ADP |