CVE-2026-56726
Received Received - Intake

Ticket Data Exposure in Zammad Prior to 7.0.2

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56726
EUVD
EUVD-2026-87212

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad to 7.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Zammad, a helpdesk system, allows any authenticated agent to view sensitive GitHub/GitLab issue data linked to tickets they do not have access to. It breaks ticket isolation boundaries, letting agents see titles, status, labels, and URLs of attached issues across the system.

Detection Guidance

To detect this vulnerability, check if your Zammad instance is running a version prior to 7.0.2. Verify the version by running: zammad version. If the version is below 7.0.2, the system is vulnerable. Additionally, inspect ticket access logs for unusual queries of unrelated ticket IDs by agents.

Impact Analysis

If you use Zammad, an internal agent could access confidential issue details linked to other tickets without permission. This could expose sensitive organizational or customer data, leading to privacy breaches or unauthorized information leaks.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using Zammad may face compliance risks, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later to address the ticket isolation boundary vulnerability. Ensure all agents are authenticated and restrict access to sensitive ticket data until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56726. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart