CVE-2026-56734
Received Received - Intake

Zammad Federated Auth Profile Image URL SSRF

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider may cause the server to connect to internal network locations. Response timing and error patterns differ between reachable and unreachable targets, allowing internal service probing. Worker processes may be blocked for several seconds per request. Requires a configured external authentication provider where the actor can modify their profile image URL. This issue is fixed in version 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56734
EUVD
EUVD-2026-87213

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad 7.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad is a helpdesk system vulnerable to server-side request forgery during federated authentication. When a user updates their profile image URL via an external identity provider (OAuth/OIDC/SAML), the system fetches the image without validating the URL target. This allows attackers who control their profile at a connected provider to probe internal network services or cause delays in worker processes.

Detection Guidance

Detecting this vulnerability requires monitoring network connections initiated by Zammad during federated authentication. Check Zammad logs for external profile image URL fetches and compare response times between internal and external targets. Use network monitoring tools like tcpdump or Wireshark to inspect outbound connections from Zammad servers during OAuth/OIDC/SAML authentication flows.

Impact Analysis

An attacker could exploit this to probe internal services, potentially discovering sensitive systems or data. The vulnerability may also cause performance issues by blocking worker processes for several seconds per request. Exploitation requires a configured external authentication provider where the attacker can modify their profile image URL.

Compliance Impact

This vulnerability could lead to unauthorized network probing, potentially exposing sensitive data or systems. Such breaches may violate compliance requirements like GDPR (data protection) or HIPAA (health information security) by enabling unauthorized access or data leaks. Organizations using Zammad should patch immediately to maintain compliance.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later immediately. Disable external authentication providers until the upgrade is complete. Review and restrict network access for Zammad servers to prevent unauthorized outbound connections. Monitor for unusual network activity or blocked worker processes during authentication attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart