A missing authorization check on Zammad's ticket creation endpoint occurs when the optional parameter used to add links is present. Because this check is omitted, an unauthenticated user can create tickets that normally require proper permissions. The flaw is an access control weakness, classified as CWE‑862, and allows attackers to add tickets that could conceal sensitive information or serve as a foothold for further compromise. The impact is limited to ticket creation, but it can be leveraged to inject malicious content or obscure legitimate support issues.

The vulnerability was present in Zammad versions earlier than 7.0.1 and 6.5.4. Users running those earlier releases of the Zammad helpdesk/customer support platform are affected. The issue was identified by Zammad's Security Advisory GHSA‑28m3‑wwgv‑ppw8.

The CVSS score of 6.9 indicates medium severity. The likely attack vector is remote, via HTTP requests to the ticket creation endpoint with the link parameter. An attacker does not need any credentials to exploit the flaw, making the threat real if the system is exposed to untrusted users.