CVE-2026-56728
Received Received - Intake

Broken Access Control in Zammad GraphQL API

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. The taskbar feature stores transient state for active user sessions, including auto-saved ticket drafts. Under certain conditions, the authorization check for taskbar item access is not enforced, allowing a user to read another user's taskbar item data. This vulnerability is fixed in 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56728
EUVD
EUVD-2026-87221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad 7.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad is a web-based open source helpdesk system. A broken access control vulnerability exists in its GraphQL API before version 7.0.2. An authenticated user can access another user's taskbar item data by using the target user's taskbar identifier. This includes auto-saved ticket drafts stored in the taskbar feature.

Detection Guidance

This vulnerability involves broken access control in Zammad's GraphQL API. Detection requires checking for unauthorized access to taskbar item data. Review GraphQL API logs for requests accessing taskbar items with user identifiers not matching the requester. Inspect network traffic for GraphQL queries targeting the taskbar endpoint with mismatched user IDs.

Impact Analysis

An attacker with valid credentials could read another user's sensitive taskbar data, such as draft tickets or session state. This could lead to information leakage, unauthorized access to drafts, or potential exposure of confidential customer or internal data.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by allowing unauthorized access to personal or health-related data. It may lead to non-compliance with confidentiality and access control obligations, potentially resulting in legal or regulatory penalties.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later to address the broken access control vulnerability in the GraphQL API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56728. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart