A weakness categorized as CWE-284 allows customers in a shared organization to view internal ticket fields that are not intended for them. The flaw arose in Zammad prior to version 7.0.1, when the detail view of a ticket opened by a user could expose fields such as priority and custom internal attributes to other organization members with customer permissions. The impact is a confidentiality breach; attackers can see sensitive information but cannot modify or delete it.

The affected product is the Zammad help‑desk platform. All releases before 7.0.1 are vulnerable. Versions 7.0.1 and later contain the patch.

The CVSS base score is 2.1, indicating low severity. There is no evidence that the vulnerability has been exploited in public or that it is listed in the KEV catalog, and its EPSS score is unavailable. Exploitation requires only an authenticated customer who belongs to a shared organization and opens a ticket from another member of the same group; no additional privileges or specialized conditions are needed. Because normal usage of the application suffices, the vulnerability is straightforward to activate.