CVE-2026-56723

Deferred Deferred - Pending Action

Information Disclosure in Zammad Helpdesk System

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachment download endpoint, bypassing article-level authorization. This results in an inconsistency: The article listing hides internal articles from customers. The attachment download only checks the parent ticket, not the article, so the same customer can download the attachment directly. This issue is fixed in version 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-56723

EUVD

EUVD-2026-87205

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Zammad is a helpdesk system. Prior to version 7.0.2, customers could not see internal ticket articles in the article listing. However, they could still download attachments from internal articles by directly accessing the attachment download endpoint. This bypassed article-level authorization because the endpoint only checked the parent ticket, not the article itself.

Detection Guidance

To detect this vulnerability, check if users with ticket viewing permissions can access attachments from internal articles. Verify if the attachment download endpoint enforces article-level permissions. Review logs for unauthorized attachment access attempts. Ensure the system is updated to version 7.0.2 or later where this issue is fixed.

Impact Analysis

If you use Zammad versions before 7.0.2, customers may access sensitive internal ticket attachments even if internal articles are hidden. This could expose confidential information to unauthorized users, leading to data leaks or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must ensure proper access controls to maintain compliance.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later to address the authorization bypass in attachment downloads for internal ticket articles.

Hi! I’m here to help you understand CVE-2026-56723. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70