CVE-2026-84460

Received Received - Intake

Authenticated User Access to Sensitive Tag Data in Zammad

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-84460

EUVD

EUVD-2026-87259

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Zammad allows any authenticated user to access tag names for any ticket via a REST endpoint, even without permission to view the ticket. Tags may contain sensitive labels, and ticket IDs are sequential, making it easy to guess and enumerate them.

Detection Guidance

Check Zammad version with 'zammad version' or via the web interface. If version is below 7.1.2, the system is vulnerable. Test by accessing /api/v1/tickets/{id}/tags endpoints with different ticket IDs to see if unauthorized tag data is returned.

Impact Analysis

An attacker could exploit this to discover sensitive ticket tags, potentially exposing internal categorization or confidential information. This could lead to data leaks or unauthorized access to ticket metadata.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR or HIPAA by allowing unauthorized access to sensitive ticket information. It could result in non-compliance due to potential data exposure.

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later immediately. Restrict API access to trusted networks or users if possible. Review tag configurations to ensure sensitive labels are not exposed.

Hi! I’m here to help you understand CVE-2026-84460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70