The issue is an authorization bypass in a GraphQL mutation that transforms knowledge base answer suggestions. It only verifies the ticket.agent permission, neglecting to check access to the answer itself, letting authenticated agents read content they shouldn’t see. This vulnerability results in information disclosure of knowledge base answers. The weakness corresponds to CWE‑862, Missing Authorization.

Affected product: Zammad, all releases prior to version 7.0.2. The vulnerability applies to any authenticated agent possessing the ticket.agent permission.

The CVSS score of 2.1 classifies the issue as low severity. EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated agent, so the attack vector is internal; no public remote exploitation is possible. The overall risk is low, but the information disclosure remains a valid concern that should be mitigated promptly.