CVE-2026-34722mediumCWE-862

CVE-2026-34722: fallo de gravedad media en zammad

Zammad is missing authorization in ticket create endpoint

Publicada el

Seguir esta CVE+ Monitorear zammad

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.2%
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
zammad · zammad
CVEs relacionadas — zammad

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-63006MEDIUMZammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcsetEPSS 0.5%CVE-2026-34723HIGHZammad has incorrect access control in getting_started_controllerEPSS 0.4%CVE-2026-56735MEDIUMZammad: Improper neutralization of `srcset` attribute in IMG tags in ZammadEPSS 0.4%CVE-2026-56725HIGHZammad: Denial of Service via OTRS Import ControllerEPSS 0.4%CVE-2026-56734MEDIUMZammad: Avatar Image URL Server-Side Request ForwardingEPSS 0.4%CVE-2026-56729LOWZammad: Titles of knowledge base answers will be shown across all categories via the global searchEPSS 0.4%