The flaw resides in Zammad's legacy destroy_form action on the AttachmentsController. The controller deletes UploadCache Store records based solely on a user‑supplied form_id without checking that the requesting user owns those records, a missing ownership verification weakness (CWE‑862). An authenticated attacker who learns another user's pending‑upload UUID can silently remove that victim's temporary file uploads before the ticket or article is submitted, resulting in loss of data the victim intended to send. The vulnerability does not grant broader disclosure or privilege escalation, so its impact is limited to unauthorized data modification.

The impacted product is the Zammad web‑based helpdesk and customer support platform provided by the vendor zammad. Versions before 7.1.2 contain the flaw; installing Zammad 7.1.2 or later resolves it.

The CVSS score of 2.3 classifies this issue as low severity. EPSS information is not available and the vulnerability is not listed in CISA's KEV catalog, indicating that exploitation is unlikely to be widespread. The attacker must have a valid authenticated session and knowledge of another user's pending‑upload UUID, which reduces the attack likelihood. Nonetheless, the flaw permits deletion of data that the victim intends to submit, creating a denial‑of‑service effect for legitimate users.