Auth bypass in Zammad
CVE-2026-13229
Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.
Vulnerability class: Broken Access Control
Affected products
- Zammad — versions 0
Weakness classification (CWE)
References
- help@fluidattacks.com (third-party-advisory)
- help@fluidattacks.com (vendor-advisory)
- help@fluidattacks.com (patch)
- help@fluidattacks.com (product)