CVE Vulnerability Catalog

In Zammad prior to 7.1.2, a user with Knowledge Base editing rights can embed a video widget with a specially crafted value that is not escaped for its attribute context. When another user with session-switching permission opens the answer, their browser sends a request to Zammad's session-switching endpoint using their own credentials, switching them to an account chosen by the answer's author.

In Zammad prior to 7.1.2, the two-factor login step allowed an attacker to try unlimited password guesses without triggering lockout or rate limiting. The response also revealed whether a guess was correct before two-factor authentication was checked.

In Zammad prior to 7.1.2, any authenticated user can call the REST endpoint for a tag list and receive tag names for any ticket regardless of access rights. Since ticket IDs are sequential integers, bulk enumeration is straightforward.

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email address the identity provider reports, without verifying that the provider actually confirmed ownership of that email. An attacker who controls any identity at a configured provider, including, by default, any Azure AD tenant via Zammad's multi-tenant Microsoft 365 /common app registration, can set that identity's email to a victim's address, authenticate, and be logged in as the victim. This bypasses the victim's local password entirely and affects any existing account, including agents and administrators. Zammad will honor the xms_edov ID token claim when email verification is required in the Microsoft 365 setting, treating a missing claim as unverified. This issue is fixed in version 7.1.2.

In Zammad prior to 7.1.2, unsanitized option labels are rendered in AI Agent configuration dialogs in the admin UI. The option label is output as raw HTML without escaping, allowing an attacker who controls the label to inject arbitrary HTML and JavaScript.

In Zammad prior to 7.1.2, when a Microsoft Graph request fails, the error is logged including the authentication token. Masking is incomplete: for the JWT format only the first part is hidden, while the remaining parts stay readable in plain text.

In Zammad 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Some responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text.

In Zammad prior to 7.1.2, the HTML sanitizer blocking remote images in ticket articles and email views can be bypassed using a shortened URL format that omits the double slash after the scheme. Modern browsers treat both forms as equivalent, so a crafted email or ticket can silently load an image from an external server.

In Zammad prior to 7.1.2, when creating or updating an email signature, inline images referenced in the signature body are processed. If the body contains an img tag pointing to an existing attachment, the system copies it into a new signature-owned record without checking the user's permission to access the original attachment.

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run belongs to a ticket the agent is not authorized to access. The disclosure is limited to the provider error string; ticket content is not exposed. This issue is fixed in version 7.1.2.

In Zammad prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie.

In Zammad 7.0.3 and 7.1.1, under certain conditions, verification of inbound PGP-signed email can mark a message as carrying a valid ("Good") signature from a registered sender key even though the displayed content is not actually covered by that signature. The article may be stored with a successful signature status that does not reflect the authenticity of the shown content.

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.

In GLPI, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy REST API interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. The issue is fixed in versions 11.0.8 and 10.0.26.

In GLPI, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. The issue is fixed in version 11.0.8.