CVE-2026-34248
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Zammad prior to version 7.0.1 allows customers in shared organizations (who can see each other's tickets) to view fields not intended for customers, including internal fields (e.g., priority, custom attributes). This occurs when a customer opens a ticket from another user in the same organization. Customers cannot modify these fields.
Risk Assessment
Breach of internal data confidentiality, as sensitive information may be exposed to unauthorized customers, potentially leading to data leakage.
Recommendation
It is recommended to update Zammad to version 7.0.1 or later.
Original NVD description (English source)
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1.