Znuny EUVD-2026-101821

Requires an authenticated Znuny session (PR:L / AU:Y) with access to ticket-search functionality, and the attacker must be able to supply the ContentSearch parameter, which the application expects to contain only the literal keyword 'AND' or 'OR' but concatenates verbatim into the SQL statement without validation. The flaw affects Znuny versions through 7.3.6 in default configurations of the ticket-search backend (Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB), so no non-default feature toggle appears necessary. Limiting factors: exploitation is gated by needing valid credentials (agent or customer account) and reachability of the search interface; it is not exploitable pre-authentication, which bounds the threat to insiders or attackers who can obtain accounts.

This is a credible, actionable priority rather than a paper-tiger high-CVSS issue, though not an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) - consistent with CWE-89 SQL injection against a backend ticket database. The attack requirement AU:Y (user authentication) and PR:L together confirm that a valid, low-privileged Znuny account is a hard prerequisite, which meaningfully narrows the attacker population to insiders or anyone able to obtain/register an agent or customer account. No EPSS score, SSVC decision, KEV listing, or POC reference was supplied: there is no public exploit identified at time of analysis and no evidence of active exploitation, so urgency rests on the vulnerability's intrinsic severity and ease, not on observed attacks. One signal to reconcile: the vector sets VA:N (no availability impact on the vulnerable system) while the description and the 'Denial Of Service' tag explicitly cite DoS as an outcome - a SQLi that permits data modification can plausibly degrade or destroy the ticket store, so defenders should treat availability as at-risk despite the VA:N scoring. Net: patch promptly given the low exploitation barrier, but absent KEV/EPSS/POC this is a standard-priority authenticated SQLi, not a drop-everything internet-worm scenario.

A low-privileged Znuny agent or customer user with access to the ticket-search functionality submits a crafted ContentSearch parameter value that breaks out of the expected 'AND'/'OR' keyword and injects arbitrary SQL into the generated ticket-search query. Because the input is concatenated directly into the statement (TicketSearch / ArticleSearchIndex::DB), the attacker can read other tenants' tickets, alter records, or issue destructive statements. No public proof-of-concept was provided, but the trivial AND/OR injection point makes exploitation straightforward for anyone with a valid account.