EUVD-2026-87214Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine cryptographic-verification defect but a moderate, not urgent, real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N, 7.1) correctly characterizes it as an integrity-only issue: no confidentiality or availability impact, network-reachable, unauthenticated, but requiring passive user interaction (a recipient must actually view and trust the signature indicator). No EPSS score, no CISA KEV listing, and no public exploit are provided - so exploitation is: no public exploit identified at time of analysis. There is no attacker-controlled code execution or data theft; the payoff is social-engineering/deception (forged 'Good signature' labels), which limits automatability of real damage even though the trigger itself is trivial. The CVSS-vector-vs-description signals are consistent (both point to remote, low-complexity forgery gated on the recipient relying on the indicator). The one caveat: the assigned CWE-287 (authentication) and the 'Authentication Bypass' tag understate/mislabel what is really improper cryptographic signature verification (CWE-347 / spoofing). Net: real bug worth patching for any org relying on Zammad's PGP trust indicators, but low widespread-exploitation risk given the niche product and deception-only impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Inbound PGP signature verification in Zammad is bypassed because the result of the gpg verification call was discarded, so the helpdesk marks every multipart/signed PGP message as 'Good signature' regardless of whether the signature is valid, invalid, or absent. Any sender can therefore tamper with the body of a signed email - or supply a fabricated or mismatched signature - and remote attackers (CVSS 4.0 vector shows PR:N, unauthenticated) can have the altered content displayed to agents and users as cryptographically verified; exploitation requires the recipient to view the affected article (UI:P) and impacts integrity only (VI:H, no confidentiality or availability impact). All inbound PGP-signed email handled while PGP integration is enabled is affected prior to 7.0.2, and at time of analysis no public exploit code or confirmed active exploitation has been identified; the practical risk is a moderate authenticity/trust defect rather than an urgent one, since it enables content forgery and misleading signature indicators but does not by itself grant code execution or data access.
RemediationAI
Vendor-released patch: upgrade Zammad to 7.0.2 (or later) as published at https://github.com/zammad/zammad/releases/tag/7.0.2, which contains the fix from commit 4a9dd5f8a85948c5a2f96f6479d785153aac05d7; see the GitHub advisory GHSA-56jc-34c8-2xq4 for details. If upgrading is not immediately possible, treat the signature indicator as untrustworthy and disable the inbound PGP integration for incoming mail so that no forged 'Good signature' label can be shown - the trade-off being loss of PGP-based authenticity and decryption handling until the upgrade is applied. Alternatively, mediate inbound signed mail at the mail gateway (for example, verify signatures before delivery or strip and quarantine signed messages for manual review) and disable any downstream workflow, macro, or rule that trusts the Zammad sign.success field; this preserves message flow but adds operational overhead and requires out-of-band key management. Because exploitation requires a recipient to open the affected article, reducing the set of addresses or queues that accept external signed mail limits exposure. Do not rely on filtering by sender key presence; the flaw also produces false success when the sender's public key is absent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is classified CWE-287 (Improper Authentication) and lives in Zammad's Ruby PGP handling for incoming mail. In lib/secure_mailing/pgp/incoming.rb, verify_signature passed the signature body to verified_result but never acted on the boolean it returned (the method unconditionally returned nil after writing the article security preferences), and the tool layer in lib/secure_mailing/pgp/tool/data.rb wrote a 'Good signature' result into the article's security metadata without conditioning on gpg's exit status. The result was that the X-Zammad article preferences blob always contained sign: { success: true, comment: 'Good signature' }, so Zammad's UI signature indicator carried no cryptographic meaning. The fix returns early when verification fails and also distinguishes inline/opaque PGP messages (which embeds the signed data and must be verified with only the signature file) from detached signatures (which require the separate data file), preventing gpg from misinterpreting an inline message as a detached signature and erroring out. The accompanying regression specs assert rejection of a tampered body and a distinct 'The public PGP key could not be found.' outcome when the sender key is missing, confirming that the pre-fix behavior collapsed all three cases - valid, invalid, and missing key - into a single success state. The CPE cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* indicates all Zammad releases before the fixed version are in scope, and the underlying technology stack is Ruby on Rails with the gpg binary invoked via a wrapper for OpenPGP verification.
Know when Zammad gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: { success: true, comment: "Good signature" } to the article's security preferences. Impact Any sender could tamper with the body of a multipart/signed PGP email, or craft a message with an entirely fabricated or mismatched signature, and Zammad would display it to the recipient as cryptographically verified with a "Good signature" label. Users and agents relying on Zammad's signature indicator to confirm message authenticity and integrity would be misled into trusting modified or forged content. The vulnerability affects all inbound PGP-signed emails processed while the PGP integration is enabled. This issue is fixed in version 7.0.2.
Technical POC Analysis
Inbound PGP verification in Zammad was performed but its result was thrown away (CWE-287 Improper Authentication; the advisory also tags CWE-347 Improper Verification of Cryptographic Signature and C…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Zammad helpdesk environments that rely on inbound PGP to authenticate email instructions can present altered or fabricated messages as verified, exposing support agents and downstream customers to trust-based fraud or process manipulation. Leadership should treat this as a loss of assurance in a key communication control rather than a broad system compromise, because impact is limited to message integrity and requires a recipient to view the affected ticket content.
Disable PGP integration or inbound PGP signature verification in Zammad; require out-of-band confirmation for sensitive email instructions; treat PGP-signed tickets as unverified; monitor vendor advisories for Zammad versions prior to 7.0.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Session hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legi
Local privilege escalation in Zammad lets an attacker who already controls the unprivileged 'zammad' service account ele
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Rated critical severity (CVS
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protecti
Zammad 5.2.0 is vulnerable to privilege escalation. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
An issue was discovered in Zammad before 4.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue was discovered in Zammad before 4.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue was discovered in Zammad before 3.4.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue was discovered in Zammad before 6.3.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely explo
Zammad's SSO auto-linking logic can be abused to take over any existing local account, including agent and administrator
An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.
An issue was discovered in Zammad before 4.1.1. Rated critical severity (CVSS 9.1), this vulnerability is remotely explo
Exploit-DB