CVE-2026-34837
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Zammad prior to version 7.0.1 contains an authorization failure in the REST endpoint POST /api/v1/ai_assistance/text_tools/:id. Context data (e.g., a group or organization) supplied for use in the AI prompt were not checked for accessibility by the current user, leading to unauthorized data being used in the prompt.
Risk Assessment
A user with ticket.agent permission can access data they should not have access to, potentially leading to leakage of confidential information.
Recommendation
Update Zammad to version 7.0.1 or later, which contains the fix.
Original NVD description (English source)
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.