CVE-2026-34722
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the endpoint used for ticket creation was missing authorization when the parameter for adding links was used, allowing unauthorized ticket creation with links.
Risk Assessment
An unauthorized user can create tickets with links, potentially leading to phishing attacks or data manipulation within the system.
Recommendation
Upgrade Zammad to version 7.0.1 or 6.5.4, which fix this vulnerability.
Original NVD description (English source)
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.