CVE-2026-56729
LOW
2,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns 'Page not found,' but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.
200
Exposure of Sensitive Information to an Unauthorized Actor
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based, Mobile
280
Improper Handling of Insufficient Permissions or Privileges
DraftCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Other
Alter Execution Logic
Applicable Platforms
All platforms may be affected
284
Improper Access Control
IncompleteCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
Technologies:
Not Technology-Specific, ICS/OT, Web Based
https://github.com/zammad/zammad/commit/5076aa1e3081146f826ffaef686c89935fdb4393
https://github.com/zammad/zammad/commit/7b6c0adec006e036c9e605c4141a091a6e08aadf
https://github.com/zammad/zammad/commit/de5dc4195829e0e1a64307d60c9e06e0e781ab37
https://github.com/zammad/zammad/security/advisories/GHSA-4m54-p3mr-22g2