Authenticated Improper Authorization in Zammad Ticket Attachment Cloning

Executive Summary

CVE-2026-13229 is an improper authorization vulnerability in Zammad version 7.0.1. It allows authenticated customers to access internal ticket article attachments they are not authorized to view. The issue occurs in the ticket article attachment cloning endpoint where the system fails to check article-level permissions despite validating access to the parent ticket.

Useful 0 Not Useful 0

Detection Guidance

Check Zammad logs for unusual activity on the /api/v1/ticket_attachment_upload_clone_by_article/:article_id endpoint. Monitor for authenticated customer requests accessing internal article attachments. Verify if GET /api/v1/attachments/:id returns files not belonging to visible tickets.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid customer account and read access to a ticket can clone attachments from internal articles (meant for agents only) into an UploadCache. The cloned files become accessible via a separate endpoint, bypassing article-level authorization. This could lead to unauthorized access to sensitive internal information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and legal consequences due to unauthorized exposure of personal or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later immediately. Review and restrict customer access to ticket articles. Audit existing attachments for unauthorized access. Implement additional authorization checks for attachment endpoints.

Useful 0 Not Useful 0