Zammad GmbH vulnerabilities
49 CVEs and advisories name Zammad GmbH as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-56729Zammad: Titles of knowledge base answers will be shown across all categories via the global search
- CVE-2026-56723Zammad: Missing authorization on ticket attachment download
- CVE-2026-56724Zammad: Incorrect implementation of permission checks in the knowledge base module
- CVE-2026-13229Zammad 7.0.1 - Improper authorization in ticket article attachment cloning
- CVE-2026-34837Zammad is miissing authorization in AI assistance controller for context data used in text tools
- CVE-2026-34782Zammad has improper access control in AI assistance controller for text tools
- CVE-2026-34724Zammad has a server-side template injection leading to RCE via AI Agent
- CVE-2026-34723Zammad has incorrect access control in getting_started_controller
- CVE-2026-34722Zammad is missing authorization in ticket create endpoint
- CVE-2026-34721Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints
- CVE-2026-34720Zammad has an origin validation error in SSO mechanism
- CVE-2026-34719Zammad has a Server-side request forgery (SSRF) via webhooks
- CVE-2026-34718Zammad improperly neutralizes of script-related HTML tags in ticket articles
- CVE-2026-34248Zammad has an information disclosure in ticket detail view of customers in shared organizations
- CVE-2025-32360In Zammad 6.4.x before 6.4.2, there is information exposure.
- CVE-2025-32359In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.
- CVE-2025-32358In Zammad 6.4.x before 6.4.2, SSRF can occur.
- CVE-2025-32357In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base
- CVE-2019-1010018Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80.