Zammad: Incorrect Authorization and Improper Privilege Management

Summary

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0.

Timeline

1. Sep 25, 2026, 5:05 PM UTCCVE published
2. Sep 25, 2026, 6:37 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 25, 2026, 6:37 PM UTCRecord last updated

Affected versions

• zammad zammad

  fixed in 7.0.2

References 5