Skip to content
Zammad vulnerabilities
Newest
-
zammad
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
CVE-2026-102490
In KEV
EPSS 10.9%
8.5 High
-
zammad
Undisclosed RCE in Zammad v6.3 and higher
CVE-2026-102489
In KEVPublic exploit
EPSS 22.5%
8.7 High
-
zammad
Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
CVE-2026-63208
5.1 Medium
-
zammad
Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
CVE-2026-63006
5.3 Medium
-
zammad
Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets
CVE-2026-63204
2.3 Low
-
zammad
Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
CVE-2026-61855
5.3 Medium
-
zammad
Zammad: Missing rate limiting allows password brute-forcing during two-factor login
CVE-2026-84461
6.9 Medium
-
zammad
Zammad: Sensitive Information Exposure in Integration Administration API
CVE-2026-63207
6.9 Medium
-
zammad
Zammad: S/MIME signature verification allows forged sender impersonation
CVE-2026-84465
7.1 High
-
zammad
Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
CVE-2026-84463
6.3 Medium
-
zammad
Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data
CVE-2026-84464
7.1 High
-
zammad
Zammad: Stored XSS via unescaped option labels in the object attribute options context UI
CVE-2026-63216
5.3 Medium
-
zammad
Zammad: Account takeover via unverified email matching during SSO auto-link
CVE-2026-84458
9.1 Critical
-
zammad
Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
CVE-2026-84460
5.3 Medium
-
zammad
Zammad: Remote image tracking bypass via shortened URL scheme
CVE-2026-63206
5.3 Medium
-
zammad
Zammad: Channel admins can read unauthorized attachments via signature rich-text body
CVE-2026-63205
5.1 Medium
-
zammad
Zammad: AI Agent template sanitizer bypass leads to remote code execution
CVE-2026-84462
8.6 High
-
zammad
Zammad: Pending upload deletion bypass via legacy attachment endpoint
CVE-2026-65828
2.3 Low
-
zammad
Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller
CVE-2026-61525
8.8 High
-
zammad
Zammad: Cross-User Taskbar Item Access Control Vulnerability
CVE-2026-56728
5.3 Medium
-
zammad
Zammad: Denial of Service via OTRS Import Controller
CVE-2026-56725
8.7 High
-
zammad
Zammad: Malicious input in Ticket Body Enables Session Termination
CVE-2026-56732
5.3 Medium
-
zammad
Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers
CVE-2026-56730
2.1 Low
-
zammad
Zammad: Incorrect Authorization and Improper Privilege Management
CVE-2026-56733
8.7 High
-
zammad
Zammad: Cross-Site Scripting in Ticket Notifications
CVE-2026-56731
8.4 High
-
zammad
Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
CVE-2026-56735
5.3 Medium
-
zammad
Zammad: PGP signature spoofing via unvalidated verification return
CVE-2026-56727
7.1 High
-
zammad
Zammad: Avatar Image URL Server-Side Request Forwarding
CVE-2026-56734
5.3 Medium
-
zammad
Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak
CVE-2026-56726
5.1 Medium
-
zammad
Zammad: Titles of knowledge base answers will be shown across all categories via the global search
CVE-2026-56729
2.1 Low
-
zammad
Zammad: Incorrect implementation of permission checks in the knowledge base module
CVE-2026-56724
7.1 High
-
zammad
Zammad: Missing authorization on ticket attachment download
CVE-2026-56723
7.1 High
-
zammad
Zammad 7.0.1 - Improper authorization in ticket article attachment cloning
CVE-2026-13229
7.1 High
-
zammad
Zammad is miissing authorization in AI assistance controller for context data used in text tools
CVE-2026-34837
5.3 Medium
-
zammad
Zammad has improper access control in AI assistance controller for text tools
CVE-2026-34782
5.3 Medium
-
zammad
Zammad has a server-side template injection leading to RCE via AI Agent
CVE-2026-34724
Public exploit
8.7 High
-
zammad
Zammad has incorrect access control in getting_started_controller
CVE-2026-34723
8.7 High
-
zammad
Zammad is missing authorization in ticket create endpoint
CVE-2026-34722
6.9 Medium
-
zammad
Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints
CVE-2026-34721
5.9 Medium
-
zammad
Zammad has an origin validation error in SSO mechanism
CVE-2026-34720
2.3 Low
-
zammad
Zammad has a Server-side request forgery (SSRF) via webhooks
CVE-2026-34719
8.3 High
-
zammad
Zammad improperly neutralizes of script-related HTML tags in ticket articles
CVE-2026-34718
5.3 Medium
-
zammad
Zammad has an information disclosure in ticket detail view of customers in shared organizations
CVE-2026-34248
2.1 Low
-
zammad
In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see...
CVE-2025-32360
4.2 Medium
-
zammad
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When...
CVE-2025-32359
4.8 Medium
-
zammad
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in...
CVE-2025-32358
4.0 Medium
-
zammad
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to...
CVE-2025-32357
4.3 Medium
-
zammad
Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and...
CVE-2024-55578
4.3 Medium
-
zammad
In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file...
CVE-2024-36078
6.7 Medium
-
zammad
An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially...
CVE-2024-33668
9.1 Critical
- Show olderLoading…