CVE-2026-34248

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/zammad/zammad/security/advisories/GHSA-prww-84vh-w978	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zammad:zammad:7.0.0:*:*:*:*:*:*:*

History

24 Jul 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Zammad es un sistema de mesa de ayuda/soporte al cliente de código abierto basado en web. Antes de la 7.0.1, los clientes en organizaciones compartidas (lo que significa que pueden ver los tickets de los demás) podían ver campos que no están destinados a los clientes, incluyendo campos que no están destinados a ellos en absoluto (por ejemplo, prioridad, atributos de ticket personalizados para fines internos). Esto ocurría cuando un cliente abría un ticket de otro usuario de la misma organización compartida. No podían modificar estos campos. Esta vulnerabilidad está corregida en la 7.0.1.

17 Apr 2026, 15:48

Type	Values Removed	Values Added
References	~~() https://github.com/zammad/zammad/security/advisories/GHSA-prww-84vh-w978 -~~	() https://github.com/zammad/zammad/security/advisories/GHSA-prww-84vh-w978 - Vendor Advisory
First Time		Zammad zammad Zammad
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.7
CPE		cpe:2.3:a:zammad:zammad:7.0.0:::::::*

08 Apr 2026, 19:25

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-08 19:25

Updated : 2026-07-24 22:10

NVD link : CVE-2026-34248

Mitre link : CVE-2026-34248

CVE.ORG link : CVE-2026-34248

JSON object : View

Products Affected

zammad

zammad

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-34248", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34248", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T15:02:10.884544Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "zammad", "product": "zammad", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.0.1"}]}]}], "published": "2026-04-08T19:25:21.567", "references": [{"url": "https://github.com/zammad/zammad/security/advisories/GHSA-prww-84vh-w978", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1."}, {"lang": "es", "value": "Zammad es un sistema de mesa de ayuda/soporte al cliente de c\u00f3digo abierto basado en web. Antes de la 7.0.1, los clientes en organizaciones compartidas (lo que significa que pueden ver los tickets de los dem\u00e1s) pod\u00edan ver campos que no est\u00e1n destinados a los clientes, incluyendo campos que no est\u00e1n destinados a ellos en absoluto (por ejemplo, prioridad, atributos de ticket personalizados para fines internos). Esto ocurr\u00eda cuando un cliente abr\u00eda un ticket de otro usuario de la misma organizaci\u00f3n compartida. No pod\u00edan modificar estos campos. Esta vulnerabilidad est\u00e1 corregida en la 7.0.1."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zammad:zammad:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "830AF7C5-9441-4C80-935E-C53BDB097BB1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}