VYPR
patchPublished Sep 25, 2026· Updated Sep 26, 2026· 1 source

Zammad: 25 Vulnerabilities Disclosed, Including Critical Flaw in SSO Authentication

Key findings • Zammad: 25 vulnerabilities disclosed on September 25, 2026, affecting multiple versions. • Critical vulnerability CVE-2026-84458 allows account takeover via flawed SSO identity…

Key findings

  • Zammad: 25 vulnerabilities disclosed on September 25, 2026, affecting multiple versions.
  • Critical vulnerability CVE-2026-84458 allows account takeover via flawed SSO identity binding.
  • High-severity flaws include improper S/MIME verification, unauthorized data access, and session hijacking.
  • Multiple vulnerabilities involve insecure HTML sanitization, email processing, and access control bypasses.
  • All issues are fixed in Zammad version 7.1.2; immediate update recommended.

On September 25, 2026, a significant batch of 25 vulnerabilities was disclosed for the Zammad open-source helpdesk system, affecting versions prior to 7.1.2, 7.0.3, 7.0.2, and 7.0.1. This coordinated disclosure event highlights several security weaknesses across different Zammad functionalities, including authentication, data handling, and content processing. The vulnerabilities range in severity from Low to Critical, with one Critical and five High-severity issues identified.

Several vulnerabilities revolve around authentication and access control. CVE-2026-84465, a High-severity flaw, involves Zammad failing to properly verify the trust of a digital signature on S/MIME-signed emails, only checking for a matching certificate name. CVE-2026-84464 (High) permits unauthorized access to tickets, users, groups, or organizations via the External Data Source feature due to insufficient verification. CVE-2026-84460 (Medium) allows any authenticated user to retrieve tag names for tickets they do not have access to. CVE-2026-63208 (Medium) logs sensitive Microsoft Graph authentication tokens due to incomplete masking during error handling. CVE-2026-56733 (High) suffers from a lack of validation during the authorization cascade for new identity objects. Furthermore, CVE-2026-56731 (High) allows low-privilege users to inject arbitrary HTML and JavaScript into ticket titles, which are then persisted without sanitization. CVE-2026-56730 (Low) bypasses access controls, enabling authenticated agents to read restricted knowledge base content. CVE-2026-56728 (Medium) involves a broken access control in the GraphQL API, allowing users to access another user's taskbar item data. CVE-2026-61525 (High) is a path traversal vulnerability in session management for websocket and long-polling connections. CVE-2026-63206 (Medium) bypasses Zammad's HTML sanitizer for remote images by using shortened URLs. CVE-2026-63006 (Medium) allows attacker-controlled HTML in inbound emails or tickets to bypass the image URL sanitizer using path traversal. CVE-2026-56735 (Medium) exploits a bypass in the HTML sanitizer's handling of the srcset attribute, allowing remote content loading. CVE-2026-56734 (Medium) fetches profile image URLs during federated authentication without verifying the target address.

Other vulnerabilities include issues with S/MIME and PGP email processing, as well as content rendering. CVE-2026-63216 (Medium) involves unsanitized option labels in AI Agent configurations being rendered as raw HTML. CVE-2026-63205 (Medium) copies existing attachments when processing inline images in email signatures. CVE-2026-61855 (Medium) incorrectly marks PGP-signed emails as valid even when the displayed content does not match the signature. CVE-2026-84462 (High) allows bypassing security filters for AI Agent configuration by entering specially crafted text. CVE-2026-63204 (Low) allows authenticated users to retrieve AI provider error messages for runs associated with tickets they don't own. CVE-2026-65828 (Low) allows authenticated attackers to delete records without proper ownership verification. CVE-2026-56732 (Medium) allows injection of specific HTML elements into ticket bodies, which can trigger logouts when viewed by other users.

The critical vulnerability, CVE-2026-84458, relates to the "Automatic account link on initial logon" setting. When enabled, Zammad binds third-party SSO identities to local accounts by matching email addresses without verifying the identity provider's reported email, potentially leading to account takeovers.

All disclosed vulnerabilities were addressed in Zammad version 7.1.2. Users are strongly advised to update to this version to mitigate the identified risks. The broad range of issues underscores the importance of regular security updates and diligent review of system configurations for Zammad users.

The batch of vulnerabilities was disclosed on September 25, 2026. All affected versions are prior to 7.1.2, 7.0.3, 7.0.2, and 7.0.1. The fix is available in Zammad version 7.1.2.

The vulnerabilities include:

  • Authentication bypass and improper access control flaws.
  • Insecure handling of email signatures and PGP/S/MIME verification.
  • Cross-site scripting (XSS) and HTML injection vulnerabilities.
  • Sensitive data exposure, including tokens and credentials.
  • Path traversal and improper input sanitization issues.
  • Flaws in AI Agent configuration and external data source integration.

The critical CVE-2026-84458 allows for account takeovers via SSO identity binding. Several High-severity issues, including CVE-2026-84465, CVE-2026-84464, CVE-2026-84462, CVE-2026-56733, CVE-2026-56731, and CVE-2026-61525, require immediate attention. The disclosure on a single day highlights a coordinated vulnerability disclosure event. All identified vulnerabilities are fixed in Zammad version 7.1.2. The range of vulnerabilities impacts various aspects of Zammad's functionality. Zammad users should update to version 7.1.2 to patch these issues.

Synthesized by Vypr AI