Zammad GmbH vulnerabilities
49 CVEs and advisories name Zammad GmbH as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-102345Zammad: Stored XSS in ticket article rendering in the new Vue-based interface
- CVE-2026-102490Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
- CVE-2026-102489Undisclosed RCE in Zammad v6.3 and higher
- CVE-2026-63208Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
- CVE-2026-63006Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
- CVE-2026-63204Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets
- CVE-2026-61855Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
- CVE-2026-84461Zammad: Missing rate limiting allows password brute-forcing during two-factor login
- CVE-2026-63207Zammad: Sensitive Information Exposure in Integration Administration API
- CVE-2026-84465Zammad: S/MIME signature verification allows forged sender impersonation
- CVE-2026-84463Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
- CVE-2026-84464Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data
- CVE-2026-63216Zammad: Stored XSS via unescaped option labels in the object attribute options context UI
- CVE-2026-84458Zammad: Account takeover via unverified email matching during SSO auto-link
- CVE-2026-84460Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
- CVE-2026-63206Zammad: Remote image tracking bypass via shortened URL scheme
- CVE-2026-63205Zammad: Channel admins can read unauthorized attachments via signature rich-text body
- CVE-2026-84462Zammad: AI Agent template sanitizer bypass leads to remote code execution
- CVE-2026-65828Zammad: Pending upload deletion bypass via legacy attachment endpoint
- CVE-2026-61525Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller
- CVE-2026-56728Zammad: Cross-User Taskbar Item Access Control Vulnerability
- CVE-2026-56725Zammad: Denial of Service via OTRS Import Controller
- CVE-2026-56732Zammad: Malicious input in Ticket Body Enables Session Termination
- CVE-2026-56730Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers
- CVE-2026-56733Zammad: Incorrect Authorization and Improper Privilege Management
- CVE-2026-56731Zammad: Cross-Site Scripting in Ticket Notifications
- CVE-2026-56735Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
- CVE-2026-56727Zammad: PGP signature spoofing via unvalidated verification return
- CVE-2026-56734Zammad: Avatar Image URL Server-Side Request Forwarding
- CVE-2026-56726Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak