CVE-2026-84465 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email… |
CVE-2026-84464 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an exte… |
CVE-2026-84463 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video… |
CVE-2026-84461 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses fo… |
CVE-2026-84460 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list an… |
CVE-2026-84458 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zamm… |
CVE-2026-63216 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI A… |
CVE-2026-63208 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the a… |
CVE-2026-63207 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credential… |
CVE-2026-63206 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and… |
CVE-2026-63205 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline image… |
CVE-2026-63204 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI ana… |
CVE-2026-63006 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the imag… |
CVE-2026-61855 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed e… |
CVE-2026-84462 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypa… |
CVE-2026-65828 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache… |
CVE-2026-61525 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections… |
CVE-2026-56735 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external U… |
CVE-2026-56734 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from… |
CVE-2026-56733 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the au… |
CVE-2026-56732 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HT… |
CVE-2026-56731 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, includ… |
CVE-2026-56730 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticate… |
CVE-2026-56728 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An au… |
CVE-2026-56727 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the g… |
CVE-2026-56726 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents… |
CVE-2026-56725 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check… |
CVE-2026-56729 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user wi… |
CVE-2026-56724 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management ar… |
CVE-2026-56723 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles throug… |
CVE-2026-13229 | | | 2026-08-04 | Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint. |
CVE-2026-34837 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an auth… |
CVE-2026-34782 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was n… |
CVE-2026-34724 | High | 7.2 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI A… |
CVE-2026-34723 | High | 7.5 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting… |
CVE-2026-34722 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization i… |
CVE-2026-34721 | Medium | 6.5 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook… |
CVE-2026-34720 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originat… |
CVE-2026-34719 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back a… |
CVE-2026-34718 | Medium | 6.1 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitiz… |
CVE-2026-34248 | Medium | 5.7 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets)… |
CVE-2025-32360 | Medium | 4.2 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer… |
CVE-2025-32359 | Medium | 4.8 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need… |
CVE-2025-32358 | Medium | 4.0 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain condit… |
CVE-2025-32357 | Medium | 4.3 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they h… |
CVE-2024-55578 | Medium | 4.3 | 2024-12-09 | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. |
CVE-2024-36078 | Medium | 6.7 | 2024-05-19 | In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify t… |
CVE-2024-33668 | Critical | 9.1 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try t… |
CVE-2024-33667 | Medium | 6.5 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoint that accepts a ge… |
CVE-2024-33666 | High | 8.6 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API… |
CVE-2023-50457 | Medium | 4.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see… |
CVE-2023-50456 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name. |
CVE-2023-50455 | High | 7.5 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests… |
CVE-2023-50454 | Medium | 5.9 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation… |
CVE-2023-50453 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration… |
CVE-2023-31597 | Medium | 6.5 | 2023-05-18 | An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers ar… |
CVE-2023-29868 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized cha… |
CVE-2023-29867 | Medium | 6.5 | 2023-05-02 | Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved… |
CVE-2022-48023 | Medium | 4.3 | 2023-02-03 | Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad… |
CVE-2022-48022 | Medium | 4.3 | 2023-02-03 | An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are no… |
CVE-2022-48021 | Critical | 9.8 | 2023-02-03 | A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server. |
CVE-2022-40817 | Medium | 4.3 | 2022-09-27 | Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some… |
CVE-2022-40816 | Medium | 6.5 | 2022-09-27 | Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal… |
CVE-2022-35490 | Critical | 9.8 | 2022-08-08 | Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable… |
CVE-2022-35489 | Medium | 6.5 | 2022-08-08 | In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are… |
CVE-2022-35488 | High | 7.5 | 2022-08-08 | In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account… |
CVE-2022-35487 | High | 7.5 | 2022-08-08 | Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an… |
CVE-2022-29701 | High | 7.5 | 2022-04-27 | A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user… |
CVE-2022-29700 | High | 7.5 | 2022-04-27 | A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during pas… |
CVE-2022-27332 | Critical | 9.1 | 2022-04-27 | An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers… |
CVE-2022-27331 | Medium | 4.3 | 2022-04-27 | An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settin… |
CVE-2021-44886 | Medium | 5.3 | 2022-02-04 | In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the origina… |
CVE-2021-43145 | High | 8.1 | 2022-02-04 | With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts. |
CVE-2021-42137 | Medium | 5.3 | 2021-10-11 | An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that sh… |
CVE-2021-42091 | Critical | 9.1 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration. |
CVE-2021-42090 | Critical | 9.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled. |
CVE-2021-42089 | High | 7.5 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. |
CVE-2021-42088 | Medium | 6.1 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled. |
CVE-2021-42087 | Medium | 4.9 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API. |
CVE-2021-42086 | High | 8.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request. |
CVE-2021-42085 | Medium | 5.4 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar. |
CVE-2021-42084 | Medium | 6.5 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and t… |
CVE-2021-42094 | Critical | 9.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages. |
CVE-2021-42093 | High | 7.2 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers. |
CVE-2021-42092 | Medium | 5.4 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket. |
CVE-2021-35303 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. |
CVE-2021-35302 | Medium | 5.3 | 2021-06-28 | Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. |
CVE-2021-35301 | Medium | 5.3 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view. |
CVE-2021-35300 | Medium | 4.3 | 2021-06-28 | Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. |
CVE-2021-35299 | High | 7.5 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. |
CVE-2021-35298 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note… |
CVE-2020-29160 | High | 7.5 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing. |
CVE-2020-29159 | Medium | 4.9 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This beh… |
CVE-2020-29158 | Medium | 4.3 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the T… |
CVE-2020-26035 | Medium | 5.4 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket. |
CVE-2020-26034 | Medium | 4.3 | 2020-12-28 | An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user t… |
CVE-2020-26033 | Medium | 5.4 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check. |
CVE-2020-26032 | High | 7.5 | 2020-12-28 | An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a tes… |
CVE-2020-26031 | Medium | 4.3 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have… |
CVE-2020-26030 | Critical | 9.8 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An atta… |