The vulnerability is a session hijack flaw that permits an attacker to take over an existing user session and execute arbitrary code with the privileges of the dedicated zammad system user. It is classified as CWE‑384, indicating that session identifiers are insufficiently protected.

Affected releases include Zammad versions 6.3.0 through 6.5.4. A similar code path exists in versions 7.0.0 to 7.1.2, but those are currently not exploitable because the underlying framework has mitigated the flaw. No other vendors or product lines are cited in the advisory.

The CVSS score of 9.4 marks it as critical, while the EPSS score of 1 % suggests a low probability of widespread exploitation. However, since the vulnerability is listed in the CISA KEV catalog, it is known to be actively exploited. Attackers would most likely obtain a session token through a hijack of an authenticated session—this is inferred from the nature of the flaw. Because the vulnerability allows remote code execution, the stakes are high.