# zammad.

Every CVE that names zammad among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Zammad: Stored XSS in ticket article rendering in the new Vue-based interface](https://agentprime.io/advisories/CVE-2026-102345.md)
  `CVE-2026-102345` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package](https://agentprime.io/advisories/CVE-2026-102490.md)
  `CVE-2026-102490` · CVE record: Zammad GmbH Zammad · CVSS 8.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.11 · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Undisclosed RCE in Zammad v6.3 and higher](https://agentprime.io/advisories/CVE-2026-102489.md)
  `CVE-2026-102489` · CVE record: Zammad GmbH Zammad · CVSS 8.7 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.22 · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens](https://agentprime.io/advisories/CVE-2026-63208.md)
  `CVE-2026-63208` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, CWE-116
- [Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset](https://agentprime.io/advisories/CVE-2026-63006.md)
  `CVE-2026-63006` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets](https://agentprime.io/advisories/CVE-2026-63204.md)
  `CVE-2026-63204` · CVE record: zammad zammad · CVSS 2.3 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail](https://agentprime.io/advisories/CVE-2026-61855.md)
  `CVE-2026-61855` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Weak cryptography or TLS
- [Zammad: Missing rate limiting allows password brute-forcing during two-factor login](https://agentprime.io/advisories/CVE-2026-84461.md)
  `CVE-2026-84461` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Authentication bypass, CWE-799
- [Zammad: Sensitive Information Exposure in Integration Administration API](https://agentprime.io/advisories/CVE-2026-63207.md)
  `CVE-2026-63207` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [Zammad: S/MIME signature verification allows forged sender impersonation](https://agentprime.io/advisories/CVE-2026-84465.md)
  `CVE-2026-84465` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute](https://agentprime.io/advisories/CVE-2026-84463.md)
  `CVE-2026-84463` · CVE record: zammad zammad · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), CWE-838
- [Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data](https://agentprime.io/advisories/CVE-2026-84464.md)
  `CVE-2026-84464` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Broken access control
- [Zammad: Stored XSS via unescaped option labels in the object attribute options context UI](https://agentprime.io/advisories/CVE-2026-63216.md)
  `CVE-2026-63216` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zammad: Account takeover via unverified email matching during SSO auto-link](https://agentprime.io/advisories/CVE-2026-84458.md)
  `CVE-2026-84458` · CVE record: zammad zammad · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration](https://agentprime.io/advisories/CVE-2026-84460.md)
  `CVE-2026-84460` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad: Remote image tracking bypass via shortened URL scheme](https://agentprime.io/advisories/CVE-2026-63206.md)
  `CVE-2026-63206` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-20, CWE-184
- [Zammad: Channel admins can read unauthorized attachments via signature rich-text body](https://agentprime.io/advisories/CVE-2026-63205.md)
  `CVE-2026-63205` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad: AI Agent template sanitizer bypass leads to remote code execution](https://agentprime.io/advisories/CVE-2026-84462.md)
  `CVE-2026-84462` · CVE record: zammad zammad · CVSS 8.6 High · Not analysed yet · Published 25 Sept 2026 · Tags: Code injection, CWE-20
- [Zammad: Pending upload deletion bypass via legacy attachment endpoint](https://agentprime.io/advisories/CVE-2026-65828.md)
  `CVE-2026-65828` · CVE record: zammad zammad · CVSS 2.3 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller](https://agentprime.io/advisories/CVE-2026-61525.md)
  `CVE-2026-61525` · CVE record: zammad zammad · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Zammad: Cross-User Taskbar Item Access Control Vulnerability](https://agentprime.io/advisories/CVE-2026-56728.md)
  `CVE-2026-56728` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Broken access control
- [Zammad: Denial of Service via OTRS Import Controller](https://agentprime.io/advisories/CVE-2026-56725.md)
  `CVE-2026-56725` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass, Denial of service
- [Zammad: Malicious input in Ticket Body Enables Session Termination](https://agentprime.io/advisories/CVE-2026-56732.md)
  `CVE-2026-56732` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site request forgery (CSRF), CWE-20
- [Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers](https://agentprime.io/advisories/CVE-2026-56730.md)
  `CVE-2026-56730` · CVE record: zammad zammad · CVSS 2.1 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad: Incorrect Authorization and Improper Privilege Management](https://agentprime.io/advisories/CVE-2026-56733.md)
  `CVE-2026-56733` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Zammad: Cross-Site Scripting in Ticket Notifications](https://agentprime.io/advisories/CVE-2026-56731.md)
  `CVE-2026-56731` · CVE record: zammad zammad · CVSS 8.4 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zammad: Improper neutralization of \`srcset\` attribute in IMG tags in Zammad](https://agentprime.io/advisories/CVE-2026-56735.md)
  `CVE-2026-56735` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-82
- [Zammad: PGP signature spoofing via unvalidated verification return](https://agentprime.io/advisories/CVE-2026-56727.md)
  `CVE-2026-56727` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-391
- [Zammad: Avatar Image URL Server-Side Request Forwarding](https://agentprime.io/advisories/CVE-2026-56734.md)
  `CVE-2026-56734` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak](https://agentprime.io/advisories/CVE-2026-56726.md)
  `CVE-2026-56726` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad: Titles of knowledge base answers will be shown across all categories via the global search](https://agentprime.io/advisories/CVE-2026-56729.md)
  `CVE-2026-56729` · CVE record: zammad zammad · CVSS 2.1 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Broken access control, CWE-280
- [Zammad: Missing authorization on ticket attachment download](https://agentprime.io/advisories/CVE-2026-56723.md)
  `CVE-2026-56723` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad: Incorrect implementation of permission checks in the knowledge base module](https://agentprime.io/advisories/CVE-2026-56724.md)
  `CVE-2026-56724` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Zammad 7.0.1 - Improper authorization in ticket article attachment cloning](https://agentprime.io/advisories/CVE-2026-13229.md)
  `CVE-2026-13229` · CVE record: Zammad Zammad · CVSS 7.1 High · Not analysed yet · Published 4 Aug 2026 · Tags: Broken access control
- [Zammad is miissing authorization in AI assistance controller for context data used in text tools](https://agentprime.io/advisories/CVE-2026-34837.md)
  `CVE-2026-34837` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [Zammad has improper access control in AI assistance controller for text tools](https://agentprime.io/advisories/CVE-2026-34782.md)
  `CVE-2026-34782` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [Zammad has a server-side template injection leading to RCE via AI Agent](https://agentprime.io/advisories/CVE-2026-34724.md)
  `CVE-2026-34724` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [Zammad has incorrect access control in getting_started_controller](https://agentprime.io/advisories/CVE-2026-34723.md)
  `CVE-2026-34723` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [Zammad is missing authorization in ticket create endpoint](https://agentprime.io/advisories/CVE-2026-34722.md)
  `CVE-2026-34722` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints](https://agentprime.io/advisories/CVE-2026-34721.md)
  `CVE-2026-34721` · CVE record: zammad zammad · CVSS 5.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Zammad has an origin validation error in SSO mechanism](https://agentprime.io/advisories/CVE-2026-34720.md)
  `CVE-2026-34720` · CVE record: zammad zammad · CVSS 2.3 Low · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-346
- [Zammad has a Server-side request forgery (SSRF) via webhooks](https://agentprime.io/advisories/CVE-2026-34719.md)
  `CVE-2026-34719` · CVE record: zammad zammad · CVSS 8.3 High · Not analysed yet · Published 8 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Zammad improperly neutralizes of script-related HTML tags in ticket articles](https://agentprime.io/advisories/CVE-2026-34718.md)
  `CVE-2026-34718` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Zammad has an information disclosure in ticket detail view of customers in shared organizations](https://agentprime.io/advisories/CVE-2026-34248.md)
  `CVE-2026-34248` · CVE record: zammad zammad · CVSS 2.1 Low · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [In Zammad 6.4.x before 6.4.2, there is information exposure.](https://agentprime.io/advisories/CVE-2025-32360.md)
  `CVE-2025-32360` · CVE record: Zammad Zammad · CVSS 4.2 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: CWE-402
- [In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.](https://agentprime.io/advisories/CVE-2025-32359.md)
  `CVE-2025-32359` · CVE record: Zammad Zammad · CVSS 4.8 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: CWE-602
- [Server-side request forgery in Zammad](https://agentprime.io/advisories/CVE-2025-32358.md)
  `CVE-2025-32358` · CVE record: Zammad Zammad · CVSS 4.0 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: Server-side request forgery (SSRF)
- [Authentication bypass in Zammad](https://agentprime.io/advisories/CVE-2025-32357.md)
  `CVE-2025-32357` · CVE record: Zammad Zammad · CVSS 4.3 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: Authentication bypass
- [Cross-site scripting in Zammad](https://agentprime.io/advisories/CVE-2019-1010018.md)
  `CVE-2019-1010018` · CVE record: Zammad GmbH Zammad · No CVSS score · Not analysed yet · Published 16 Jul 2019 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zammad>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zammad/>. Everything for agents: <https://agentprime.io/llms.txt>.