Zammad CVE-2026-56726

Requires an authenticated Zammad agent account (any privilege level, including one with zero assigned tickets) and the GitHub and/or GitLab issue-tracker integration configured with tickets that have linked external issues. The attacker calls the integration query action with a ticket_id parameter; because the pre-7.0.2 controller only performed authenticate_and_authorize! without a per-ticket authorize!(ticket, :show?), it discloses linked-issue metadata for tickets the agent has no rights to see. Limiting factors: exploitation is confined to authenticated internal users, exposes only issue metadata (titles, status, labels, URLs) rather than ticket contents or API tokens, and yields nothing if no tickets in the instance use the GitHub/GitLab integration.

This is a genuine but low-severity authorization flaw (CWE-862, broken object-level access control / IDOR). The NVD CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N) correctly captures the shape: network-reachable, low complexity, requires an authenticated low-privilege agent account, and yields only limited confidentiality impact (issue titles, status, labels, and URLs of linked GitHub/GitLab issues) with no integrity or availability impact. The UI:P designation is questionable - the source diff shows the vulnerable Integration::GitHubController/GitLabController #query action only ran authenticate_and_authorize! (a coarse permission check) without a per-ticket authorize!(ticket, :show?), so an attacker can enumerate ticket IDs programmatically with no victim interaction; I assess UI:N, which slightly raises real-world accessibility but the impact ceiling stays low. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, consistent with a low-priority internal-threat issue rather than an actively exploited one. Net: this is a real data-isolation defect worth patching, but it is a bounded information-disclosure issue exploitable only by already-trusted internal agents, not a high-urgency remotely-weaponizable vulnerability. The single confirmed limiting factor is that it exposes only metadata of externally-linked issues, not ticket bodies or credentials.

A low-privileged Zammad agent with no assigned tickets scripts requests to the GitHub/GitLab integration query endpoint, iterating over sequential or random ticket IDs. Because the controller authorized only the caller's general permission and never checked per-ticket visibility, the server returns the titles, status, labels, and URLs of GitHub/GitLab issues linked to any other agent's or admin's tickets, letting the insider harvest cross-organization issue metadata. No public exploit code is known, but the attack is trivial to automate given a valid agent session.