The Zammad helpdesk system contains a flaw in the REST endpoint used to call AI‑based text tools. An authenticated user with ticket.agent permission can submit context data—such as group or organization information—that is not checked for proper authorization before it is inserted into the AI prompt. As a result, sensitive data that the user should not access can be exposed through the AI assistance function. This vulnerability represents a typical missing authorization weakness, allowing unauthorized reading of confidential information.

All installations of the open‑source Zammad helpdesk running releases earlier than version 7.0.1 are vulnerable, regardless of the environment or deployment size.

The flaw scores 5.3 on a standard severity scale, indicating moderate risk. No publicly available exploitation probability data are reported, and the issue is not catalogued as a widely exploited vulnerability. Exploitation requires the attacker to already possess a ticket.agent level account; the attack path is therefore internal and requires the ability to construct and send a request to the susceptible API endpoint. The potential impact is limited to confidentiality exposure, not integrity or availability.