Zammad EUVD-2026-87257

Requires an authenticated Zammad account holding at least one channel-admin permission: admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph. The attacker uses the email-signature create/update feature and must reference an existing attachment's ID via an inline HTML img tag. Limiting factors: high privilege prerequisite (channel administration), impact confined to reading (copying) attachments the actor cannot otherwise access - no write/modify or DoS - and it applies to Zammad instances prior to 7.1.2. No end-user interaction and no non-default configuration are required beyond having the admin channel permission.

This is a low-to-moderate real-world risk despite being network-exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N, 5.1) correctly captures the two dominant limiting factors: the attacker must already hold high privileges (one of the admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions), and the impact is confidentiality-only and rated Low. This is a horizontal/broken-object-level authorization flaw (CWE-639 IDOR): a channel-admin can read attachments outside their group scope, but only reads - no integrity or availability impact. Exploitation status: no public exploit identified at time of analysis - there is no KEV listing, no EPSS score, and no POC provided; note that the fix commit (f3e4da83) and the GHSA advisory publicly reveal the exact mechanism (an img tag referencing an arbitrary attachment ID), which lowers the barrier to reproduction. No SSVC data was supplied. The PR:H requirement means the actor is already a trusted administrative operator, so this is primarily a privilege-boundary/insider or compromised-admin-account concern rather than mass-exploitable exposure. Signal alignment: CVSS, CWE, and the source diff all agree this is an authorization gap, not an authentication bypass as the input tag claims.

A user holding a Zammad channel-admin permission (e.g. admin.channel_email) but who is NOT a member of a given ticket group creates or edits an email signature whose HTML body contains an <img> tag pointing at the numeric attachment ID of a restricted ticket or knowledge-base attachment. Zammad copies that attachment into a new signature-owned record without checking the actor's access to the original, and the channel-admin then downloads the copy - reading data they were denied. No public exploit code is known, but the fix commit publicly documents the technique.