# cve.now: Zammad GmbH

The newest entries naming Zammad GmbH as an affected vendor (up to 200), of 49 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-102345](https://cve.now/CVE-2026-102345.md): Zammad: Stored XSS in ticket article rendering in the new Vue-based interface (CVSS 5.1)
- [CVE-2026-102490](https://cve.now/CVE-2026-102490.md): Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package (CVSS 8.5, KEV)
- [CVE-2026-102489](https://cve.now/CVE-2026-102489.md): Undisclosed RCE in Zammad v6.3 and higher (CVSS 8.7, KEV)
- [CVE-2026-63208](https://cve.now/CVE-2026-63208.md): Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens (CVSS 5.1)
- [CVE-2026-63006](https://cve.now/CVE-2026-63006.md): Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset (CVSS 5.3)
- [CVE-2026-63204](https://cve.now/CVE-2026-63204.md): Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets (CVSS 2.3)
- [CVE-2026-61855](https://cve.now/CVE-2026-61855.md): Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail (CVSS 5.3)
- [CVE-2026-84461](https://cve.now/CVE-2026-84461.md): Zammad: Missing rate limiting allows password brute-forcing during two-factor login (CVSS 6.9)
- [CVE-2026-63207](https://cve.now/CVE-2026-63207.md): Zammad: Sensitive Information Exposure in Integration Administration API (CVSS 6.9)
- [CVE-2026-84465](https://cve.now/CVE-2026-84465.md): Zammad: S/MIME signature verification allows forged sender impersonation (CVSS 7.1)
- [CVE-2026-84463](https://cve.now/CVE-2026-84463.md): Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute (CVSS 6.3)
- [CVE-2026-84464](https://cve.now/CVE-2026-84464.md): Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data (CVSS 7.1)
- [CVE-2026-63216](https://cve.now/CVE-2026-63216.md): Zammad: Stored XSS via unescaped option labels in the object attribute options context UI (CVSS 5.3)
- [CVE-2026-84458](https://cve.now/CVE-2026-84458.md): Zammad: Account takeover via unverified email matching during SSO auto-link (CVSS 9.1)
- [CVE-2026-84460](https://cve.now/CVE-2026-84460.md): Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration (CVSS 5.3)
- [CVE-2026-63206](https://cve.now/CVE-2026-63206.md): Zammad: Remote image tracking bypass via shortened URL scheme (CVSS 5.3)
- [CVE-2026-63205](https://cve.now/CVE-2026-63205.md): Zammad: Channel admins can read unauthorized attachments via signature rich-text body (CVSS 5.1)
- [CVE-2026-84462](https://cve.now/CVE-2026-84462.md): Zammad: AI Agent template sanitizer bypass leads to remote code execution (CVSS 8.6)
- [CVE-2026-65828](https://cve.now/CVE-2026-65828.md): Zammad: Pending upload deletion bypass via legacy attachment endpoint (CVSS 2.3)
- [CVE-2026-61525](https://cve.now/CVE-2026-61525.md): Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller (CVSS 8.8)
- [CVE-2026-56728](https://cve.now/CVE-2026-56728.md): Zammad: Cross-User Taskbar Item Access Control Vulnerability (CVSS 5.3)
- [CVE-2026-56725](https://cve.now/CVE-2026-56725.md): Zammad: Denial of Service via OTRS Import Controller (CVSS 8.7)
- [CVE-2026-56732](https://cve.now/CVE-2026-56732.md): Zammad: Malicious input in Ticket Body Enables Session Termination (CVSS 5.3)
- [CVE-2026-56730](https://cve.now/CVE-2026-56730.md): Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers (CVSS 2.1)
- [CVE-2026-56733](https://cve.now/CVE-2026-56733.md): Zammad: Incorrect Authorization and Improper Privilege Management (CVSS 8.7)
- [CVE-2026-56731](https://cve.now/CVE-2026-56731.md): Zammad: Cross-Site Scripting in Ticket Notifications (CVSS 8.4)
- [CVE-2026-56735](https://cve.now/CVE-2026-56735.md): Zammad: Improper neutralization of \`srcset\` attribute in IMG tags in Zammad (CVSS 5.3)
- [CVE-2026-56727](https://cve.now/CVE-2026-56727.md): Zammad: PGP signature spoofing via unvalidated verification return (CVSS 7.1)
- [CVE-2026-56734](https://cve.now/CVE-2026-56734.md): Zammad: Avatar Image URL Server-Side Request Forwarding (CVSS 5.3)
- [CVE-2026-56726](https://cve.now/CVE-2026-56726.md): Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak (CVSS 5.1)
- [CVE-2026-56729](https://cve.now/CVE-2026-56729.md): Zammad: Titles of knowledge base answers will be shown across all categories via the global search (CVSS 2.1)
- [CVE-2026-56723](https://cve.now/CVE-2026-56723.md): Zammad: Missing authorization on ticket attachment download (CVSS 7.1)
- [CVE-2026-56724](https://cve.now/CVE-2026-56724.md): Zammad: Incorrect implementation of permission checks in the knowledge base module (CVSS 7.1)
- [CVE-2026-13229](https://cve.now/CVE-2026-13229.md): Zammad 7.0.1 - Improper authorization in ticket article attachment cloning (CVSS 7.1)
- [CVE-2026-34837](https://cve.now/CVE-2026-34837.md): Zammad is miissing authorization in AI assistance controller for context data used in text tools (CVSS 5.3)
- [CVE-2026-34782](https://cve.now/CVE-2026-34782.md): Zammad has improper access control in AI assistance controller for text tools (CVSS 5.3)
- [CVE-2026-34724](https://cve.now/CVE-2026-34724.md): Zammad has a server-side template injection leading to RCE via AI Agent (CVSS 8.7)
- [CVE-2026-34723](https://cve.now/CVE-2026-34723.md): Zammad has incorrect access control in getting\_started\_controller (CVSS 8.7)
- [CVE-2026-34722](https://cve.now/CVE-2026-34722.md): Zammad is missing authorization in ticket create endpoint (CVSS 6.9)
- [CVE-2026-34721](https://cve.now/CVE-2026-34721.md): Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints (CVSS 5.9)
- [CVE-2026-34720](https://cve.now/CVE-2026-34720.md): Zammad has an origin validation error in SSO mechanism (CVSS 2.3)
- [CVE-2026-34719](https://cve.now/CVE-2026-34719.md): Zammad has a Server-side request forgery (SSRF) via webhooks (CVSS 8.3)
- [CVE-2026-34718](https://cve.now/CVE-2026-34718.md): Zammad improperly neutralizes of script-related HTML tags in ticket articles (CVSS 5.3)
- [CVE-2026-34248](https://cve.now/CVE-2026-34248.md): Zammad has an information disclosure in ticket detail view of customers in shared organizations (CVSS 2.1)
- [CVE-2025-32360](https://cve.now/CVE-2025-32360.md): In Zammad 6.4.x before 6.4.2, there is information exposure. (CVSS 4.2)
- [CVE-2025-32359](https://cve.now/CVE-2025-32359.md): In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. (CVSS 4.8)
- [CVE-2025-32358](https://cve.now/CVE-2025-32358.md): In Zammad 6.4.x before 6.4.2, SSRF can occur. (CVSS 4.0)
- [CVE-2025-32357](https://cve.now/CVE-2025-32357.md): In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base (CVSS 4.3)
- [CVE-2019-1010018](https://cve.now/CVE-2019-1010018.md): Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zammad
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.