Zammad CVE-2026-56724

Requires an authenticated Zammad user holding limited knowledge-base permissions (e.g., an agent with only read/editor-scoped access) on a Zammad instance older than 7.0.2 that uses the Knowledge Base feature. The flaw is reachable via the knowledge_base/answer attachments controller endpoints (create/destroy/clone_to_form), where the old policy authorized broadly by role ('knowledge_base.editor'/'knowledge_base.*') instead of validating the specific answer's access scope. Limiting factors: valid low-privilege account needed (not fully unauthenticated), impact confined to knowledge-base answer attachments, and the fix restricts create/destroy to answer update rights and clone_to_form to answer show rights.

This is an authorization/access-control flaw (CWE-639, insecure direct object reference on knowledge-base answer IDs) rather than a memory-corruption or RCE issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, base 7.1) indicates network-reachable, low-complexity exploitation by an already-authenticated low-privilege user with no user interaction. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code in the provided data, so this is not a confirmed-exploited emergency - it is a moderate-severity broken-access-control bug fixed in a routine release. I disagree with the NVD's VC:H rating: the fixed endpoints (create/destroy attachments tied to answer_policy.update?, clone_to_form tied to answer_policy.show?) expose knowledge-base answer attachments - limited internal helpdesk content - and also permit unauthorized modification (add/remove attachments), so the real impact is closer to Confidentiality:Low plus Integrity:Low rather than a single high-confidentiality impact. Net: a legitimate priority to patch for Zammad operators, but not a high-real-risk internet-wide threat.

An authenticated Zammad agent with only limited/read knowledge-base permissions enumerates knowledge-base answer IDs and calls the answer attachments controller endpoints, whose policy previously granted access broadly to 'knowledge_base.editor'/'knowledge_base.*' instead of validating per-answer scope. The attacker thereby views (clone_to_form) or modifies (add/remove) attachments on knowledge-base answers outside their assigned access scope. No public exploit code is identified, but the fix commit and policy spec make the flaw and access path clear.