Zammad CVE-2026-56730

Requires an authenticated Zammad agent account holding the ticket.agent permission but lacking access to the target knowledge base category/answer (e.g. an internal answer). The attacker must reach the GraphQL 'KnowledgeBase::Answer::Suggestion::Content::Transform' mutation and supply the translationId of an answer outside their KB permissions. Exploitation is limited by the need for valid agent credentials, knowledge of a valid translation/answer ID, and applies only to Zammad instances before 7.0.2 that use the knowledge base feature with category-level access restrictions; impact is confined to disclosure of KB answer text.

This is a low-priority, low-real-risk issue despite being a genuine authorization flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N) scores only 2.1, and every signal points to limited impact: the only consequence is confidentiality of knowledge-base answer content (VC:L), with no integrity or availability effect. Exploitation requires an already-authenticated agent account (PR:L) plus an attack requirement (AT:P) and passive user interaction (UI:P), and the leaked data is internal helpdesk KB text rather than credentials or PII. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data - consistent with 'no public exploit identified.' The one clear data-quality issue is the 'Authentication Bypass' tag: the root cause (CWE-862, a missing authorization check on the KB answer while ticket.agent permission is still verified) is an authorization bypass by an already-authenticated user, not an authentication bypass. No conflicting access-vector signals exist - the GraphQL mutation is genuinely network-reachable, matching AV:N.

A logged-in Zammad agent who has the ticket.agent permission but lacks access to a restricted/internal knowledge base category calls the GraphQL 'transform' mutation, passing the translationId of an answer they should not be able to read. Because the mutation only checked ticket.agent and resolved the object with verified_object_from_id (no per-object authorization), the server returns the transformed answer content. No public exploit code is identified at time of analysis; exploitation is trivial for any agent who can enumerate or guess answer/translation IDs.