CVE-2026-56729lowCWE-200CWE-280CWE-284

CVE-2026-56729: low-severity vulnerability in zammad

Zammad: Titles of knowledge base answers will be shown across all categories via the global search

Published

Follow this CVE+ Monitor zammad

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.1epss 0.4%
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
zammad · zammad
Related CVEs — zammad

In the same product, most dangerous first.

CVE-2026-63006MEDIUMZammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcsetEPSS 0.5%CVE-2026-34723HIGHZammad has incorrect access control in getting_started_controllerEPSS 0.5%CVE-2026-56735MEDIUMZammad: Improper neutralization of `srcset` attribute in IMG tags in ZammadEPSS 0.4%CVE-2026-56725HIGHZammad: Denial of Service via OTRS Import ControllerEPSS 0.4%CVE-2026-56734MEDIUMZammad: Avatar Image URL Server-Side Request ForwardingEPSS 0.4%CVE-2026-84458CRITICALZammad: Account takeover via unverified email matching during SSO auto-linkEPSS 0.4%