CVE-2026-56727
Received Received - Intake

PGP Signature Verification Bypass in Zammad

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: { success: true, comment: "Good signature" } to the article's security preferences. Impact Any sender could tamper with the body of a multipart/signed PGP email, or craft a message with an entirely fabricated or mismatched signature, and Zammad would display it to the recipient as cryptographically verified with a "Good signature" label. Users and agents relying on Zammad's signature indicator to confirm message authenticity and integrity would be misled into trusting modified or forged content. The vulnerability affects all inbound PGP-signed emails processed while the PGP integration is enabled. This issue is fixed in version 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56727
EUVD
EUVD-2026-87214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad 7.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-391 [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad is a helpdesk system that processes PGP-signed emails. Prior to version 7.0.2, it incorrectly verified email signatures by always marking them as valid, even if the signature was invalid or missing. This allowed attackers to modify email content or forge signatures while Zammad displayed them as cryptographically verified.

Detection Guidance

Check Zammad version with 'zammad version' or via the web interface. Inspect PGP-signed emails in Zammad for incorrect 'Good signature' labels despite potential tampering. Review email headers and PGP signatures manually for mismatches between content and signature.

Impact Analysis

Users and agents relying on Zammad's signature indicator could be misled into trusting tampered or forged emails. Attackers could manipulate email content or signatures, leading to unauthorized actions or misinformation being treated as legitimate.

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing tampered or forged PGP-signed emails to be processed as authentic. Users relying on cryptographic verification may trust modified content, violating integrity and authenticity requirements in these regulations.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later immediately. Disable PGP email processing temporarily if an upgrade is not immediately possible. Monitor inbound emails for suspicious signatures or content mismatches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56727. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart