Approved changes feed: RSS · Atom
cpe:2.3:a:zammad:zammad:7.0.0:*:*:*:*:*:*:*part: a version: 7.0.0 update: *
| Vendor | Zammad (c4a18e0f-7b9e-5129-8049-726b820feeed) |
|---|---|
| Product | Zammad (9e29b17c-6410-5005-8a60-aa1ce52c8044) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/zammad/zammad |
purl2cpe | 2026-06-01 10:16:54.962429 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-34837 |
vulnerable | 2026-06-08 07:59:13.230456 |
Zammad is miissing authorization in AI assistance controller for context data used in text tools
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.
Published: 2026-04-08T18:20:00.977Z
Updated: 2026-04-08T19:52:03.644Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34782 |
vulnerable | 2026-06-08 07:59:13.140633 |
Zammad has improper access control in AI assistance controller for text tools
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations. This vulnerability is fixed in 7.0.1 and 6.5.4.
Published: 2026-04-08T18:18:32.044Z
Updated: 2026-04-09T14:22:06.575Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34724 |
vulnerable | 2026-06-08 07:59:13.040505 |
Zammad has a server-side template injection leading to RCE via AI Agent
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.
Published: 2026-04-08T18:17:30.178Z
Updated: 2026-04-09T16:17:29.350Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34723 |
vulnerable | 2026-06-08 07:59:13.040100 |
Zammad has incorrect access control in getting_started_controller
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was completed. This vulnerability is fixed in 7.0.1 and 6.5.4.
Published: 2026-04-08T18:14:08.582Z
Updated: 2026-04-10T20:40:49.909Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34722 |
vulnerable | 2026-06-08 07:59:13.039811 |
Zammad is missing authorization in ticket create endpoint
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.
Published: 2026-04-08T18:13:20.927Z
Updated: 2026-04-08T19:51:42.966Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34721 |
vulnerable | 2026-06-08 07:59:13.039427 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34720 |
vulnerable | 2026-06-08 07:59:13.039148 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34719 |
vulnerable | 2026-06-08 07:59:13.038868 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34718 |
vulnerable | 2026-06-08 07:59:13.038516 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34248 |
vulnerable | 2026-06-08 07:59:11.953972 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.