CVE-2026-13229 | | | 2026-08-04 | Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint. |
CVE-2026-34837 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an auth… |
CVE-2026-34782 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was n… |
CVE-2026-34724 | High | 7.2 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI A… |
CVE-2026-34723 | High | 7.5 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting… |
CVE-2026-34722 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization i… |
CVE-2026-34721 | Medium | 6.5 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook… |
CVE-2026-34720 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originat… |
CVE-2026-34719 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back a… |
CVE-2026-34718 | Medium | 6.1 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitiz… |
CVE-2026-34248 | Medium | 5.7 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets)… |
CVE-2025-32360 | Medium | 4.2 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer… |
CVE-2025-32359 | Medium | 4.8 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need… |
CVE-2025-32358 | Medium | 4.0 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain condit… |
CVE-2025-32357 | Medium | 4.3 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they h… |
CVE-2024-55578 | Medium | 4.3 | 2024-12-09 | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. |
CVE-2024-36078 | Medium | 6.7 | 2024-05-19 | In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify t… |
CVE-2024-33668 | Critical | 9.1 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try t… |
CVE-2024-33667 | Medium | 6.5 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoint that accepts a ge… |
CVE-2024-33666 | High | 8.6 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API… |
CVE-2023-50457 | Medium | 4.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see… |
CVE-2023-50456 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name. |
CVE-2023-50455 | High | 7.5 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests… |
CVE-2023-50454 | Medium | 5.9 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation… |
CVE-2023-50453 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration… |
CVE-2023-31597 | Medium | 6.5 | 2023-05-18 | An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers ar… |
CVE-2023-29868 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized cha… |
CVE-2023-29867 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved… |
CVE-2022-48023 | Medium | 4.3 | 2023-02-03 | Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad… |
CVE-2022-48022 | Medium | 4.3 | 2023-02-03 | An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are no… |
CVE-2022-48021 | Critical | 9.8 | 2023-02-03 | A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server. |
CVE-2022-40817 | Medium | 4.3 | 2022-09-27 | Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some… |
CVE-2022-40816 | Medium | 6.5 | 2022-09-27 | Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal… |
CVE-2022-35490 | Critical | 9.8 | 2022-08-08 | Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable… |
CVE-2022-35489 | Medium | 6.5 | 2022-08-08 | In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are… |
CVE-2022-35488 | High | 7.5 | 2022-08-08 | In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account… |
CVE-2022-35487 | High | 7.5 | 2022-08-08 | Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an… |
CVE-2022-29701 | High | 7.5 | 2022-04-27 | A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user… |
CVE-2022-29700 | High | 7.5 | 2022-04-27 | A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during pas… |
CVE-2022-27332 | Critical | 9.1 | 2022-04-27 | An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers… |
CVE-2022-27331 | Medium | 4.3 | 2022-04-27 | An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settin… |
CVE-2021-44886 | Medium | 5.3 | 2022-02-04 | In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the origina… |
CVE-2021-43145 | High | 8.1 | 2022-02-04 | With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts. |
CVE-2021-42137 | Medium | 5.3 | 2021-10-11 | An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that sh… |
CVE-2021-42091 | Critical | 9.1 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration. |
CVE-2021-42090 | Critical | 9.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled. |
CVE-2021-42089 | High | 7.5 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. |
CVE-2021-42088 | Medium | 6.1 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled. |
CVE-2021-42087 | Medium | 4.9 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API. |
CVE-2021-42086 | High | 8.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request. |
CVE-2021-42085 | Medium | 5.4 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar. |
CVE-2021-42084 | Medium | 6.5 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and t… |
CVE-2021-42094 | Critical | 9.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages. |
CVE-2021-42093 | High | 7.2 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers. |
CVE-2021-42092 | Medium | 5.4 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket. |
CVE-2021-35303 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. |
CVE-2021-35302 | Medium | 5.3 | 2021-06-28 | Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. |
CVE-2021-35301 | Medium | 5.3 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view. |
CVE-2021-35300 | Medium | 4.3 | 2021-06-28 | Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. |
CVE-2021-35299 | High | 7.5 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. |
CVE-2021-35298 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note… |
CVE-2020-29160 | High | 7.5 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing. |
CVE-2020-29159 | Medium | 4.9 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This beh… |
CVE-2020-29158 | Medium | 4.3 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the T… |
CVE-2020-26035 | Medium | 5.4 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket. |
CVE-2020-26034 | Medium | 4.3 | 2020-12-28 | An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user t… |
CVE-2020-26033 | Medium | 5.4 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check. |
CVE-2020-26032 | High | 7.5 | 2020-12-28 | An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a tes… |
CVE-2020-26031 | Medium | 4.3 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have… |
CVE-2020-26030 | Critical | 9.8 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An atta… |
CVE-2020-26029 | Medium | 6.5 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks ar… |
CVE-2020-26028 | Medium | 4.9 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. |
CVE-2020-14214 | Medium | 6.5 | 2020-06-16 | Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new ac… |
CVE-2020-14213 | Medium | 5.4 | 2020-06-16 | In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge). |
CVE-2020-10105 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Di… |
CVE-2020-10104 | Medium | 4.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an… |
CVE-2020-10103 | Medium | 5.4 | 2020-03-05 | An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad… |
CVE-2020-10102 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid… |
CVE-2020-10101 | High | 7.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is… |
CVE-2020-10100 | Medium | 6.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the applica… |
CVE-2020-10099 | Medium | 5.4 | 2020-03-05 | An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The… |
CVE-2020-10098 | Medium | 5.4 | 2020-03-05 | An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious J… |
CVE-2020-10097 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information… |
CVE-2020-10096 | High | 7.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely comp… |
CVE-2019-1010018 | Medium | 6.1 | 2019-07-16 | Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The compone… |
CVE-2018-1000154 | Medium | 6.1 | 2018-04-05 | Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject… |
CVE-2017-6081 | High | 8.8 | 2017-03-13 | A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain… |
CVE-2017-6080 | Critical | 9.8 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Cont… |
CVE-2017-5621 | Medium | 6.1 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the co… |
CVE-2017-5620 | Medium | 6.1 | 2017-03-13 | An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attachments are opened in a new tab instead of getting download… |
CVE-2017-5619 | Critical | 9.8 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself (e.g., from the… |