Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Zammad — Vulnerabilities & Security Advisories 48

All 48 CVE vulnerabilities found in Zammad, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses affecting the Zammad open-source help desk software developed by the Zammad GmbH vendor. The collection encompasses a wide spectrum of vulnerability classes including cross-site scripting, privilege escalation, and information disclosure issues discovered in the product since its initial public release through the most recent stable versions. Readers can utilize this resource to track official security advisories published by the Zammad team, analyze the prevalence and impact of specific weakness categories within customer support platforms, or review the complete historical record of security flaws associated with this particular application. The data presented here serves as a centralized reference for security professionals, system administrators, and developers seeking to assess the risk profile of their Zammad deployments without navigating fragmented sources. By consolidating these findings, the page facilitates efficient vulnerability management and supports informed decision-making regarding patching priorities and configuration hardening. No specific CVE identifiers are listed in this summary, but the underlying dataset provides direct links to detailed technical reports for each entry. This compilation remains neutral and factual, focusing strictly on the existence, nature, and remediation status of reported defects rather than promotional content or vendor commentary.

Vendor: Zammad GmbH

CVE ID Title CVSS Severity Published
CVE-2026-56723 Zammad: Missing authorization on ticket attachment download CWE-863 7.1 High 2026-09-25
CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module CWE-639 7.1 High 2026-09-25
CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning CWE-862 7.1 High 2026-08-04
CVE-2026-34837 Zammad is miissing authorization in AI assistance controller for context data used in text tools CWE-862 7.1AI High AI 2026-04-08
CVE-2026-34782 Zammad has improper access control in AI assistance controller for text tools CWE-862 8.8AI High AI 2026-04-08
CVE-2026-34724 Zammad has a server-side template injection leading to RCE via AI Agent CWE-94 7.2AI High AI 2026-04-08
CVE-2026-34723 Zammad has incorrect access control in getting_started_controller CWE-284 7.5AI High AI 2026-04-08
CVE-2026-34722 Zammad is missing authorization in ticket create endpoint CWE-862 4.3AI Medium AI 2026-04-08
CVE-2026-34721 Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints CWE-352 8.8AI High AI 2026-04-08
CVE-2026-34720 Zammad has an origin validation error in SSO mechanism CWE-346 7.1AI High AI 2026-04-08
CVE-2026-34719 Zammad has a Server-side request forgery (SSRF) via webhooks CWE-918 6.5AI Medium AI 2026-04-08
CVE-2026-34718 Zammad improperly neutralizes of script-related HTML tags in ticket articles CWE-80 5.4AI Medium AI 2026-04-08
CVE-2026-34248 Zammad has an information disclosure in ticket detail view of customers in shared organizations CWE-284 3.5AI Low AI 2026-04-08
CVE-2025-32360 Zammad 安全漏洞 CWE-402 4.2 Medium 2025-04-05
CVE-2025-32357 Zammad 安全漏洞 CWE-288 4.3 Medium 2025-04-05
CVE-2025-32359 Zammad 安全漏洞 CWE-602 4.8 Medium 2025-04-05
CVE-2025-32358 Zammad 安全漏洞 CWE-918 4.0 Medium 2025-04-05
CVE-2019-1010018 Zammad 跨站脚本漏洞 CWE-80 6.1 - 2019-07-16

All 48 known CVE vulnerabilities affecting Zammad with full Chinese analysis, references, and POCs where available.