EUVD-2026-87205Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine but bounded broken-authorization (CWE-863) flaw, not an inflated high-CVSS issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network-reachable, low complexity, requires low privilege (an authenticated customer), no user interaction, and pure confidentiality impact with zero integrity or availability effect - matching a data-exposure bug precisely. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is: no public exploit identified at time of analysis. The commit diff and added regression tests independently confirm the root cause (the attachment endpoint authorized only the parent ticket, not the article) and the fix (an added authorize!(article, :show?) check), which raises confidence in the technical claims well above a description-only assessment. The realistic priority is moderate: exploitation needs a legitimate customer account with visibility into a ticket that actually contains internal articles with attachments, so this is an insider/tenant boundary exposure rather than a mass-exploitable remote flaw. The VC:H rating is defensible because internal articles frequently hold sensitive agent-only notes, though in tickets with no internal attachments the practical impact is nil. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Internal article attachments in Zammad helpdesk before 7.0.2 can be pulled down by the very customer who owns the ticket, because the attachment download API authorizes only against the parent ticket and never against the article itself (CWE-863). Any authenticated customer with normal view access to a ticket (CVSS v4.0 PR:L, AV:N) can therefore retrieve files attached to internal notes that the article listing API deliberately withholds, giving a confidentiality-only impact with no integrity, availability, or scope change. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment characterizes this as a genuine but bounded broken-authorization flaw rather than an inflated high-CVSS issue, and a vendor patch is available in 7.0.2.
RemediationAI
Vendor-released patch: upgrade to Zammad 7.0.2, which adds the missing article-level authorization (authorize!(article, :show?)) in app/controllers/ticket_articles_controller.rb and is published at https://github.com/zammad/zammad/releases/tag/7.0.2; the underlying change is commit e661d00efb3d2c4ef4af3a36ce79d7c724323f97 and full details are in advisory GHSA-374g-4f73-g7m7. If an immediate upgrade is not possible, back-port the single authorize! call to the attachment action of the affected controller - this is a low-risk, self-contained change, and the vendor specs (customer 404/403 for internal-note attachments, agent 200) are a ready-made verification test. Operators who cannot patch should not rely on hiding internal notes in the UI, since the listing filter is not the enforcement point; instead, temporarily restrict or block the attachment download routes at the reverse proxy for customer sessions (breaking legitimate attachment access for customers until the patch lands), or audit existing internal articles for sensitive attachments and rotate/move that content, treating any file already attached to an internal note as potentially disclosed to the ticket's customer. Because exploitation requires an authenticated customer and exposes only data they could already reach at the ticket level, compensating controls should focus on limiting which account holders can open the affected tickets rather than network-level blocking; note that disabling attachment downloads entirely also removes agents' ability to read files, so scope any such rule to the customer-facing endpoint only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zammad is a Ruby on Rails open-source helpdesk and customer-support platform in which every ticket contains articles, and articles can be flagged internal so they are visible only to agents. Attachments are persisted through the application's Store model, which records the owning object (Ticket::Article) and its o_id, and are served through dedicated download endpoints such as /api/v1/attachments/:id and /api/v1/ticket_attachment/:ticket_id/:article_id/:attachment_id. The root cause is CWE-863 (Incorrect Authorization): the attachment action of app/controllers/ticket_articles_controller.rb performed an authorization check against the parent ticket only, so once a customer could read the ticket, every attachment reachable through that ticket - including those belonging to internal-only articles - passed the check. Article-level visibility was enforced solely by the article listing API, which filters internal articles out, creating the inconsistency the advisory describes. The upstream fix adds an explicit 'authorize!(article, :show?)' call in the attachment action (commit e661d00efb3d2c4ef4af3a36ce79d7c724323f97), so the article's own policy now gates the download; the accompanying specs assert that a ticket customer receives 404 on /api/v1/attachments/:id and 403 on /api/v1/ticket_attachment/... for an internal note's file, while an agent still receives 200. The supplied CPE cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* is a wildcard across versions, consistent with 'all releases prior to 7.0.2' being affected.
Know when Zammad gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachment download endpoint, bypassing article-level authorization. This results in an inconsistency: The article listing hides internal articles from customers. The attachment download only checks the parent ticket, not the article, so the same customer can download the attachment directly. This issue is fixed in version 7.0.2.
Technical POC Analysis
The flaw is CWE-863 (Incorrect Authorization): an authorization check is performed, but against the wrong object.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Zammad helpdesk installations running versions before 7.0.2 allow the customer who owns a ticket to download file attachments from internal notes - precisely the material the internal-note feature exists to withhold from them. Because the flaw requires only an ordinary customer login plus the normal ticket visibility that customer already has, it can quietly expose staff-only commentary, pricing rationale, escalation threads, or sensitive attachments directly to the account holder with no exploit tooling and no privileged access. Leadership should treat this as a bounded but genuine confidentiality exposure in customer-facing support operations, not a system-wide compromise, since no integrity or availability impact and no public exploit have been identified.
Apply vendor patch: upgrade to Zammad 7.0.2 or later, as cited in the advisory. Until every instance is upgraded, refrain from attaching sensitive files to internal notes (reference them through a separate access-controlled location instead), and monitor attachment download API activity for requests against articles the caller cannot list.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Session hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legi
Local privilege escalation in Zammad lets an attacker who already controls the unprivileged 'zammad' service account ele
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Rated critical severity (CVS
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protecti
Zammad 5.2.0 is vulnerable to privilege escalation. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
An issue was discovered in Zammad before 4.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue was discovered in Zammad before 4.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue was discovered in Zammad before 3.4.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue was discovered in Zammad before 6.3.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely explo
Zammad's SSO auto-linking logic can be abused to take over any existing local account, including agent and administrator
An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.
An issue was discovered in Zammad before 4.1.1. Rated critical severity (CVSS 9.1), this vulnerability is remotely explo
Exploit-DB