A customer who has permission to view a ticket is able to fetch attachments belonging to internal ticket articles via the attachment download endpoint, even though the article listing API correctly hides those internal articles. The bug allows the customer to bypass article‑level authorization and retrieve potentially sensitive data from internal articles. This represents an access‑control weakness (CWE‑863) that can lead to confidential information disclosure.

The vulnerability affects the open‑source Zammad helpdesk platform. All releases prior to version 7.0.2 are impacted, including the 7.0.x series before the 7.0.2 update. The product is known simply as “Zammad” and is maintained by the Zammad project.

The CVSS base score is 7.1, indicating a high severity of risk. No EPSS score is available in the current data, so the estimated likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs the ability to interact with the public API and legitimate ticket access; from there the exploit path is a simple HTTP request to the attachment download endpoint, which does not verify article ownership, enabling the bypass.