Zammad CVE-2026-56734

Requires a configured external federated authentication provider (OAuth, OIDC, or SAML) on the Zammad instance AND an attacker who can modify the profile image URL of their own account at that provider (PR:L authenticated at the IdP). Exploitation is server-side and needs no victim user interaction (UI:N), but it is limited to environments that have enabled federated login - a non-default deployment choice - and the outcome is blind: the attacker infers internal reachability only from response timing/error patterns rather than reading full responses. The per-request worker block (several seconds) is a minor availability side effect, not a full DoS.

This is a genuine but low-to-moderate priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L, base 5.3) is internally consistent with the description: network reachable, low complexity, but requiring privileges (PR:L) because the attacker must control a profile at a federated identity provider connected to the target Zammad instance. Impact is deliberately capped at VC:L/VA:L - this is a BLIND SSRF where the attacker learns internal state only through response-timing and error-pattern differences, not by exfiltrating full responses, and the availability effect is limited to a worker being blocked for several seconds per request. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active or automated exploitation. The main factors keeping real-world risk down are the two hard preconditions (a configured OAuth/OIDC/SAML provider AND attacker-controllable profile image URL) and the niche deployment footprint of self-hosted Zammad. No signals conflict; the CVSS vector, CWE-918, and description all align on a limited-impact authenticated blind SSRF.

An attacker who can authenticate through a federated provider connected to a Zammad instance edits their own profile image URL at that provider to point to an internal address (e.g. a metadata endpoint, loopback service, or private RFC1918 host). During federated login/avatar sync, Zammad's server fetches that URL without validating the target, connecting to the internal resource; the attacker observes reachable-vs-unreachable timing and error differences to map internal services and can tie up worker processes. No public exploit code is identified at time of analysis.