Zammad EUVD-2026-87259

Requires a valid authenticated Zammad account of any privilege level (PR:L) - including a customer or limited agent lacking access to the target tickets - reachable over the network with no user interaction. The affected endpoint is the tag-list/autocomplete query whose policy granted access to any authenticated user prior to 7.1.2. Exploitation is limited to reading tag names (a confidentiality-only leak, no modification or DoS), and is naturally aided by sequential integer ticket IDs enabling bulk enumeration; it is fully closed by upgrading to Zammad 7.1.2, which restricts the endpoint to ticket.agent/admin.tag/knowledge_base.editor permissions.

All signals point to a low-priority information-disclosure flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, base 5.3) captures it accurately: network-reachable and low-complexity, but requiring an authenticated account (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability effect. This maps to a CVSS 3.1 equivalent of roughly 4.3. There is no EPSS score, no CISA KEV listing, and no public exploit code provided, so this is 'no public exploit identified at time of analysis' - not active exploitation. No SSVC decision data was supplied. The one factor that mildly elevates practical risk is that ticket IDs are sequential integers, making bulk enumeration of tag names across all tickets trivial for any logged-in user; still, the leaked data (internal tag labels) is bounded and non-critical. Net: a real but low-severity authorization (IDOR) defect, not a high-priority emergency. Note the vector is CVSS 4.0 only; no 3.1 vector was provided in the input.

A low-privileged authenticated Zammad user (e.g. a customer or limited agent) calls the tag-list endpoint for ticket IDs they do not own. Because the tags controller/GraphQL autocomplete policy returned true for any authenticated user, they receive the tag names of arbitrary tickets, and by iterating sequential integer ticket IDs they enumerate tag labels across the whole system. No public exploit code is identified, but the attack is a trivial scripted loop over ticket IDs.