Znuny versions up to 7.3.6 contain a flaw in the HTTPBasicAuth authentication modules where the application accepts a user identifier from an attacker‑controllable HTTP header named Remote‑User in addition to the server‑trusted REMOTE_USER environment variable. This weakness—an instance of Untrusted Value Used for Privilege Determination—enables an adversary to impersonate any valid user without any credentials, granting full access to confidential data and critical system functions.

The vulnerability affects the Znuny ticketing system, specifically all releases through and including version 7.3.6. The flaw resides in the Kernel::System::Auth::HTTPBasicAuth and Kernel::System::CustomerAuth::HTTPBasicAuth modules, and any deployment that relies on HTTPBasicAuth as the authentication backend is susceptible.

The CVSS score of 9.5 reflects that the flaw is remote and can be exploited without authentication, providing full system compromise. The EPSS metric is not available, so the current likelihood of exploitation cannot be quantified, but because the attack only requires sending a forged Remote‑User header, it is trivial to attempt from any connected client. The vulnerability is not listed in the CISA KEV catalog at this time, but its severity and remote nature warrant immediate action. Attackers can conduct the exploit by crafting an HTTP request with a Remote‑User header set to any username, such as an administrator, and the application will honor that value as a valid login, bypassing all password checks.