Zammad is missing authorization in ticket create endpoint_CVE-2026-34722

6.9 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.

Basic Information

ID CVE-2026-34722

Source GitHub_M

Published Apr 8, 2026 at 18:13

Modified Apr 8, 2026 at 19:51

Affected Product

Vendor zammad

Product zammad

Version < 6.5.4

Affected Versions zammad zammad < 6.5.4
zammad zammad >= 7.0.0-alpha, < 7.0.1

CWE Classification

CWE-862

References

github.com /zammad/zammad/security/advisories/GHSA-28m3-wwgv-ppw8

{
    "lastseen": "",
    "description": "Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.",
    "published": "2026-04-08T18:13:20.927Z",
    "modified": "2026-04-08T19:51:42.966Z",
    "type": "cve",
    "title": "Zammad is missing authorization in ticket create endpoint",
    "source": "GitHub_M",
    "references": "https://github.com/zammad/zammad/security/advisories/GHSA-28m3-wwgv-ppw8",
    "id": "CVE-2026-34722",
    "bulletinFamily": "",
    "cwe": [
        "CWE-862"
    ],
    "cvelist": null,
    "sourceData": "zammad zammad < 6.5.4\nzammad zammad >= 7.0.0-alpha, < 7.0.1",
    "sourceHref": "",
    "cvss": {
        "score": 6.9,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "zammad",
    "version": "< 6.5.4",
    "vendor": "zammad",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}