Zammad’s External Data Source feature allows an authenticated user to submit a request to an external system containing a record ID. Before version 7.1.2 the application fails to confirm that the user has permission to view that record; the external system then receives ticket, user, group, or organization details that the requester is not authorized to see. The flaw enables a user with any level of access, including a basic customer, to read private data belonging to other users, customers, or teams. The vulnerability is a classic Insecure Direct Object Reference. The affected component is the External Data Source renderer in Zammad before 7.1.2. Any installation of the open‑source helpdesk that has not been updated to at least version 7.1.2 is susceptible, regardless of the underlying operating system or database platform. The CVSS score of 7.1 indicates a medium to high severity, reflecting the potential impact on confidentiality and integrity. No EPSS metric is available, and the issue is not listed in CISA’s KEV catalog, but the vulnerability can be exploited by any authenticated user who can reference a valid record ID. Attackers do not require elevated privileges, so the risk is broadly applicable to any user with access to the system. The bug is exploitable without additional prerequisites beyond authentication, and the exploitation path is straightforward through normal use of the External Data Source feature.

Zammad, the open‑source web‑based helpdesk and customer support system, is affected for all installations running version 7.1.1 or earlier. Any deployment of Zammad that has not yet applied the 7.1.2 update is vulnerable, regardless of the underlying operating system or database platform.

The CVSS score of 7.1 indicates a medium to high severity level, directly impacting confidentiality. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the lack of these metrics does not reduce the potential impact for organizations relying on Zammad. The flaw is exploitable by any authenticated user who can reference another record’s ID; no elevated privileges or additional prerequisites are needed. Attackers can simply use the External Data Source feature to initiate lookups for tickets, users, groups, or organizations that they are not authorized to view, thereby reading protected sensitive information.