Zammad EUVD-2026-87221

Requires an authenticated Zammad account with API/GraphQL access (any low-privilege user/agent suffices - PR:L) and knowledge or enumeration of the target user's taskbar item identifier. Exploitation targets the taskbar feature, which stores transient session state including auto-saved ticket drafts. The advisory notes the missing authorization check applies 'under certain conditions,' so it may not trigger on every taskbar access path. Limiting factors: authentication is mandatory (no unauthenticated exploitation), impact is confined to one victim's taskbar item per request, and only transient draft/session data is exposed - not the full ticket store or credentials. Affects Zammad versions prior to 7.0.2.

This is a genuine broken-access-control (IDOR-style) flaw in Zammad's GraphQL API, but a low-severity one. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, base 5.3) is internally consistent with the description: network-reachable, low attack complexity, and requiring an authenticated low-privilege account (PR:L). There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis - so exploitation status is 'no public exploit identified at time of analysis.' None of the signals point to widespread or automated exploitation; this is a targeted, low-impact data-exposure issue against a niche self-hosted product rather than a priority mass-exploitation candidate. One notable discrepancy: NVD scores integrity as VI:N (read-only exposure), yet the fix commit adds Pundit authorization not only to reads but to the Delete (destroy?), Update (update?), and TouchLastContact (update?) mutations - implying an attacker could also modify or delete another user's taskbar items (auto-saved ticket drafts), which is an integrity impact the official vector omits. My independent assessment therefore raises integrity to I:L. Overall a real but low-priority bug: authenticated-only, single-victim data at a time, confined to transient taskbar state.

A low-privileged authenticated Zammad user (e.g. any agent) crafts a GraphQL request supplying another user's taskbar item identifier. Because the authorization check on the taskbar item is not enforced, the server returns that user's transient session state - including auto-saved ticket drafts - and, per the fix, the attacker could also update, touch, or delete those items. No public exploit code exists, but the attack is trivial to construct once the target's taskbar ID is known or enumerated.