Zammad’s inbound PGP email handling silently ignored the result of the GPG verification step. Consequently the system always recorded the message as positively verified regardless of whether the signature was valid, invalid, or absent. This flaw means attackers can tamper with the email body or fabricate a signed message, and the application will present it to the user with a “Good signature” indicator. The weakness involves improper validation of the verification return value (CWE-287, CWE-347, CWE-391) and creates a false sense of authenticity for users and agents who rely on the signature status to determine message integrity.

All versions of Zammad older than 7.0.2 that have the inbound PGP integration enabled are affected. This includes the open‑source Zammad help‑desk platform from vendor zammad. The vulnerability was identified in releases prior to the 7.0.2 update, which contains the fix that correctly processes the GPG verification return value.

With a CVSS score of 7.1 the vulnerability is rated as high severity. The EPSS score is unavailable but the flaw is straightforward to exploit once inbound PGP is active: an attacker simply sends a malformed or self‑signed message. Because the flaw lies entirely in client‑side display logic, no authentication or elevated privileges are required. The issue is not listed in the CISA KEV catalog, yet the risk of misleading users remains significant, especially in environments where signature verification is a key security control.