Zammad incorrectly accepts an invalid PGP detached signature as a valid (“Good”) signature for inbound mail, while the message body is not actually covered by the signature. This flaw causes agents to believe that potentially altered or malicious emails are authentic, leading to a false sense of trust. The weakness aligns with CWE‑347, where a system treats an invalid or manipulated message as trustworthy.

The bug affects Zammad version 7.0.3 and 7.1.1. Admins using these releases should note that any inbound mail signed with a key registered in the system may be stored with a misleading signature status.

The CVSS score of 5.3 indicates a medium‑level risk, and with the EPSS score unavailable there is no clear estimate of current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to craft an inbound PGP‑signed message that references a sender key registered in the target Zammad instance, which can then be accepted as valid even though the content is changed.