Zammad and its knowledge base management module suffered from an incorrect implementation of permission checks. Data validation for linked items was not fully enforced, enabling users granted only limited read permissions to interact with and view items outside their intended access scope. This flaw can result in unauthorized disclosure of knowledge base content and may also allow users to perform actions on behalf of others. The weakness aligns with CWE-639 and CWE-862 and can be exploited by any authenticated user who has access to the web interface.

The vulnerability affects all Zammad installations running a version prior to 7.0.2. Many deployments of the open‑source helpdesk application use the default build provided by the zammad:zammad vendor and were therefore exposed until the 7.0.2 release was applied. All affected systems use a web‑based front‑end to manage knowledge base entries.

The CVSS score of 7.1 reflects a high impact associated with the permission bypass, yet the EPSS score is not available which indicates a lack of current exploitation data. The vulnerability is not listed in the CISA KEV catalog. Exploitation is likely achievable via the standard web UI when an attacker has a valid authenticated session with at least read privileges. No remote code execution or privilege escalation beyond the user level is required, but the potential to read protected knowledge base items poses a substantial confidentiality risk.