Auth bypass in Zammad
CVE-2026-34837
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.
Vulnerability class: Broken Access Control
EPSS: 0.002 (7.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Zammad — versions 7.0.0, >= 7.0.0, < 7.0.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-34837?
- CVE-2026-34837 is a medium-severity vulnerability in Zammad, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-04-08.
- How severe is CVE-2026-34837?
- Medium severity. CVSS v3 base score is 4.3 out of 10.