Which versions of Zammad are affected by CVE-2026-13229?

Zammad helpdesk software versions 7.1.0-7.1.1 contain a data access control flaw enabling staff to view customer attachments and communications beyond their authorized scope, exposing sensitive…. A patch is available.

How to fix or mitigate CVE-2026-13229?

Within 24 hours, verify if your organization runs Zammad 7.1.0 or 7.1.1 and audit recent attachment access logs for suspicious activity by non-assigned staff. Within 7 days, apply vendor patch 7.1.2 to all Zammad instances after testing in a staging environment to ensure compatibility. Within 30 days, conduct a full security audit of attachment access during the vulnerability window and review any sensitive documents accessed to confirm whether unauthorized disclosure occurred.

Zammad CVE-2026-13229

Q: What is the CVSS score of CVE-2026-13229?

CVE-2026-13229 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52856 HIGH

Missing Authorization (CWE-862)

2026-08-04 Fluid Attacks

Authentication Bypass Zammad

7.1

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint requires only a low-privilege authenticated session; no scope change and no integrity or availability impact apply.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:51 vuln.today

CVE Published

Aug 04, 2026 - 18:12 cve.org

HIGH 7.1

DescriptionCVE.org

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.

AnalysisAI

Authenticated low-privilege users in Zammad 7.1.0 can access confidential ticket article attachments beyond their authorization scope via a missing authorization check in the attachment cloning endpoint. The flaw, classified as CWE-862 (Missing Authorization), allows any authenticated user to clone and retrieve attachments from tickets they should not have access to, enabling cross-tenant or cross-ticket data leakage in helpdesk environments. No public exploit code or CISA KEV listing has been identified at time of analysis; a patched release (7.1.2) is available from the vendor.

Technical ContextAI

Zammad is an open-source web-based helpdesk and ticketing system. The vulnerable component is its ticket article attachment cloning endpoint, which lacks adequate authorization enforcement (CWE-862 - Missing Authorization). In a properly secured multi-tenant or role-segregated helpdesk deployment, access to ticket attachments should be gated on the requesting user's permissions relative to the owning ticket and customer group. Here, that gate is absent or insufficiently enforced, meaning the endpoint processes clone requests without verifying that the authenticated caller holds rights over the target ticket. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) confirms network-accessible exploitation by a low-privilege authenticated user with no attack complexity or additional prerequisites. The CPE cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* as filed uses a wildcard version range, though the description and patch reference point specifically to the 7.1.0 release line, resolved in 7.1.2.

RemediationAI

Upgrade Zammad to version 7.1.2, which addresses this improper authorization flaw per the vendor patch at https://github.com/zammad/zammad/releases/tag/7.1.2 and the security advisory at https://github.com/zammad/zammad/security/advisories/GHSA-374g-4f73-g7m7. If an immediate upgrade is not possible, administrators should restrict Zammad account creation to fully trusted internal users only, eliminating the low-privilege attacker prerequisite; this reduces exposure but does not eliminate the underlying vulnerability and may not be feasible for customer-facing portals. Additionally, consider disabling or rate-limiting the attachment cloning endpoint at the application or reverse-proxy layer if the feature is not operationally required, accepting the trade-off of losing cloning functionality. Monitor Zammad access logs for anomalous cross-ticket attachment requests as a detective control pending patching.