An authenticated user can invoke the REST endpoint that lists tags for a specified ticket even if the user lacks permission for that ticket. The endpoint exposes the tag names associated with tickets, and those tags may contain confidential information. The vulnerability is based on improper authorization control (CWE‑639) and leads to information disclosure, but does not provide code execution or denial of service.

Affected is the Zammad help‑desk application from the vendor Zammad. All releases prior to version 7.1.2 are vulnerable. The issue is fixed starting with 7.1.2.

The CVSS score of 5.3 indicates moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. However, because the API is accessible to any authenticated user, an attacker who can log into the system can directly request the tag list for sequential ticket IDs, enabling straightforward enumeration of sensitive internal labels.