Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0.
Published: 2026-09-25
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The flaw in Zammad’s authorization cascade allows token‑based access control to be bypassed by parent account permissions. An attacker can therefore create new administrator accounts under conditions that appear to be restricted, granting full access to all tickets, customers, and configuration data. This results in a complete loss of data integrity and the ability to subvert the entire helpdesk system.

Affected Systems

All installations of Zammad before version 7.0.2 and 7.1.0 are affected. The issue is present in the open‑source web‑based helpdesk application distributed under the Zammad brand.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote exploitation through the web interface, where an attacker with a token that has limited scope can create an administrator account and thus elevate privileges. The impact is the potential for full control over the Zammad instance and access to all sensitive data.

Generated by OpenCVE AI on September 25, 2026 at 20:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Zammad 7.0.2 or 7.1.0 to fix the improper privilege management issue (CWE‑269) and prevent unauthorized escalation of privileges.
  • Revoke any unauthorized administrator accounts created due to the lack of proper authorization checks (CWE‑863) and audit current account privileges.
  • Restrict token permissions and audit current token scopes to ensure no further privilege escalation can occur (CWE‑269).

Generated by OpenCVE AI on September 25, 2026 at 20:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Zammad
Zammad zammad
Vendors & Products Zammad
Zammad zammad

Fri, 25 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0.
Title Zammad: Incorrect Authorization and Improper Privilege Management
Weaknesses CWE-269
CWE-863
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Zammad Zammad
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-25T18:37:48.132Z

Reserved: 2026-06-22T19:17:28.959Z

Link: CVE-2026-56733

cve-icon Vulnrichment

Updated: 2026-09-25T18:37:41.810Z

cve-icon NVD

Status : Deferred

Published: 2026-09-25T18:17:27.533

Modified: 2026-09-28T14:45:39.697

Link: CVE-2026-56733

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T10:45:11Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-863

    Incorrect Authorization