CVE-2026-56729

Deferred Deferred - Pending Action

Information Disclosure in Zammad Helpdesk System

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-56729

EUVD

EUVD-2026-87208

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-280	The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Zammad is a helpdesk system. Prior to version 7.0.2, a flaw allowed users with editor access in one knowledge base category to view answer titles and update timestamps from other categories they lack access to through a global quick search. The category names remain hidden, and attempting to open the answer shows a 'Page not found' error.

Detection Guidance

This vulnerability can be detected by checking the Zammad version installed on your system. If the version is below 7.0.2, the system is vulnerable. Run the command: zammad version to check the installed version. If the output shows a version lower than 7.0.2, update Zammad immediately to version 7.0.2 or later.

Impact Analysis

This vulnerability may expose sensitive information through answer titles and update timestamps, even if the full content is inaccessible. Attackers could infer confidential data based on titles, potentially leading to privacy breaches or unauthorized knowledge of internal processes.

Compliance Impact

The vulnerability may lead to unauthorized disclosure of sensitive information through answer titles and timestamps, which could violate data protection requirements under GDPR and HIPAA if such data is considered personal or health-related.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later to address the vulnerability. Review KB category editor role assignments to ensure proper access controls are in place.

Hi! I’m here to help you understand CVE-2026-56729. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70