Vulnerability details
CVE-2026-84464
zammad zammad
Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data
CVSS 4.0
7.1High
Official description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including its details in a request to that external system. An authenticated user, including one with only basic customer access, could exploit this by referencing another record's ID, and thereby view details of tickets, customer accounts, teams, or organizations that did not belong to them. This issue is fixed in version 7.1.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| zammad | zammad | < 7.1.2 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/zammad/zammad/security/advisories/GHSA-jvm2-cr58-4qxp x_refsource_CONFIRM
- https://github.com/zammad/zammad/commit/34bdf46273adbea03821ac7157c8beaacde03a4b x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-25
- Last updated
- 2026-09-25
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.29%
Probability of exploitation in 30 days
21.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor
- CWE-639Authorization Bypass Through User-Controlled Key
- CWE-863Incorrect Authorization