Medium severity4.3NVD Advisory· Published Apr 8, 2026· Updated Apr 17, 2026
CVE-2026-34837
CVE-2026-34837
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/zammad/zammad/security/advisories/GHSA-89vv-6639-wcv8nvdVendor Advisory
News mentions
0No linked articles in our index yet.