Zammad’s GitHub and GitLab integration module fails to perform an authorization check when retrieving integration data for tickets. As a result, any authenticated agent—even those with no active tickets—can request and view the titles, status, labels, and URLs of third‑party issues attached to every ticket in the system. This flaw constitutes an authorization bypass (CWE‑862) and directly compromises the confidentiality of linked issue information within the helpdesk platform.

All Zammad releases before version 7.0.2 are vulnerable, including every 6.x build and earlier 7.x versions. The remediation was introduced in the 7.0.2 release and later updates, so any deployment that has not applied that upgrade remains susceptible.

The CVSS score of 5.1 places the vulnerability in the moderate threat tier. No EPSS information is available and the flaw is not listed in CISA’s KEV catalog, indicating limited public awareness of active exploitation. The attack requires only that the user be an authenticated internal agent, meaning the vulnerability can be exercised by any such user simply by enumerating ticket identifiers. Until a patch is deployed, the risk remains at the level described above.