Prior to version 7.0.2, Zammad performs an automatic image fetch when users authenticate through external identity providers such as OAuth, OIDC, or SAML. The URL supplied for a user’s avatar is recorded by the provider and then fetched by Zammad without verifying that the target is an allowed or public location. An attacker who can control the avatar URL in their identity provider profile can point this URL at any reachable address, and Zammad will attempt to connect to that address. Because the server’s response time and error messages differ for reachable versus unreachable targets, the attacker can use timing differences to probe for internal services. Additionally, the worker processes that perform the fetch can become blocked for several seconds for each request, which may degrade service availability for legitimate users.

The affected system is the Zammad helpdesk application, specifically any version released before 7.0.2. Both the community and enterprise editions are vulnerable when federated authentication is configured and a user’s avatar URL is under the attacker’s control. Updated releases of 7.0.2 and later contain a fix that validates the URL and prevents internal requests.

The CVSS score of 5.3 indicates a medium severity risk. No EPSS score is available, so the likelihood of exploitation cannot be quantified, but the vulnerability does not require user interaction beyond influencing the attacker’s own provider profile. The attack vector is inferred to be internal SSRF, wherein the attacker relies on the target’s ability to modify their avatar URL. The vulnerability is not listed in CISA’s KEV catalog. Once patched, the risk is eliminated; until then, internal services could be exposed to probing and potential denial of service from the blocked worker processes.