CVE-2026-56725
Received Received - Intake

Denial of Service in Zammad via Unauthenticated Import Check

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions are missing the setup_done_response guard that other actions in the same controller carry, so they execute on fully set-up production instances. The action enters a retry loop against a blank OTRS endpoint, sleeping for 30 s + 45 s between attempts. Impact An unauthenticated remote attacker denies service to a production Zammad instance. Each request costs almost nothing and forces ~115 seconds of server-side blocking. A few requests per second saturate the Puma worker pool. The condition persists as long as the traffic continues. No account, valid import configuration, or target knowledge beyond the hostname is needed. CSRF token is trivially obtained from any prior GET response. This issue is fixed in version 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56725
EUVD
EUVD-2026-87220

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad 7.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad is a web-based open source helpdesk system. This vulnerability allows an unauthenticated attacker to send a specific POST request to /api/v1/import/otrs/import_check, which causes a Zammad request worker to block for about two minutes. The issue occurs because the import_check and import_status actions lack a setup_done_response guard present in other controller actions, causing them to run on fully set-up production instances. The worker enters a retry loop against a non-existent OTRS endpoint, sleeping for 30 and 45 seconds between attempts.

Detection Guidance

Monitor for repeated POST requests to /api/v1/import/otrs/import_check from unauthenticated sources. Check Zammad server logs for worker blockages lasting ~115 seconds per request. High CPU or memory usage in Zammad workers may indicate exploitation.

Impact Analysis

An unauthenticated remote attacker can deny service to a production Zammad instance by sending a few requests per second. Each request blocks the server for approximately 115 seconds, saturating the Puma worker pool. The attack requires no account, valid import configuration, or target knowledge beyond the hostname. The condition persists as long as traffic continues, severely degrading system performance.

Compliance Impact

This vulnerability enables denial-of-service attacks that could disrupt availability of Zammad instances. For GDPR, availability is a key principle, so prolonged outages may violate Article 32 requirements for resilience. For HIPAA, service disruption could impact access to critical support systems, potentially affecting covered entities' operations.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later immediately. If upgrading is not possible, restrict access to the /api/v1/import/otrs/import_check endpoint via network firewall rules or web application firewall (WAF) blocking rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart