Zammad, before version 7.0.2, contains a broken access control flaw in its GraphQL API that allows an authenticated user to retrieve taskbar item data belonging to another user. Crafting a request with the target user’s taskbar identifier bypasses the authorization check under certain conditions, exposing transient session data such as auto‑saved ticket drafts. The vulnerability enables the attacker to gain confidential information about other users’ activity and draft content without altering system state, effectively creating a privacy breach.*

All Zammad installations running any version earlier than 7.0.2 are affected. The problem resides in the GraphQL endpoint that manages taskbar items, regardless of the deployment platform or deployment size.*

The CVSS score of 5.3 places the vulnerability in the medium severity range. No EPSS data is available, but the flaw is not listed in the CISA KEV catalog, suggesting a lower current exploitation likelihood. Exploitation requires valid credentials and access to the public GraphQL API; an attacker simply sends a crafted query with another user’s taskbar identifier. This path allows direct read of another user’s taskbar contents, compromising confidentiality.*