Zammad EUVD-2026-87224

Requires an authenticated account on the affected Zammad instance (PR:L) running a version prior to 7.1.2 with the legacy destroy_form action on AttachmentsController reachable. The decisive limiting factor is that the attacker must know the victim's specific pending-upload form_id UUID, which is not enumerable predictably - this is why CVSS assigns AC:H and why the score is low. Exploitation only affects uploads that are still in the temporary UploadCache stage (not yet committed to a submitted ticket or article), so timing against a victim's in-progress composition is also required. No non-default feature or configuration toggle is needed beyond a standard Zammad deployment.

This is a genuinely low-priority issue whose signals are internally consistent - not a high-CVSS-but-low-real-risk mismatch. The NVD CVSS 4.0 base score of 2.3 (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) reflects the reality: exploitation requires authentication (PR:L), succeeds only under high attack complexity (AC:H) because the attacker must first learn a victim's unpredictable pending-upload form_id UUID, and yields no confidentiality impact and only minor integrity/availability harm (deletion of another user's not-yet-submitted temporary attachments). No EPSS score, KEV listing, or public POC is present in the provided data - absence of these is expected for a low-impact vandalism bug and does not indicate suppressed risk. There is no SSVC decision data supplied. The only conflicting metadata is the tag 'Authentication Bypass,' which mischaracterizes a missing-authorization (CWE-862) flaw - the attacker is authenticated and the defect is a broken ownership check, not an auth bypass. Bottom line: real but minor, appropriately scored low; patch during normal maintenance cadence.

An authenticated Zammad user (e.g., another agent or customer on the instance) obtains or guesses another user's pending-upload form_id UUID and sends a request to the legacy destroy_form action on AttachmentsController, which deletes UploadCache Store records matching that form_id without checking ownership. The victim's temporary file uploads silently vanish before they submit their ticket or article, causing lost work and confusion. No public exploit is identified at time of analysis; the practical barrier is discovering the target's UUID, which is why CVSS rates attack complexity high.