Zammad: Mehrere Schwachstellen
WID-SEC-2026-3753 · first 06.10.2026 · updated 06.10.2026 · CVSS 9,1
What it is about
Zammad ist ein Helpdesk- und Ticketsystem. Ein Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- seine Privilegien zu erhöhen
- beliebigen Code auszuführen
- Sicherheitsmaßnahmen zu umgehen
- Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen
Am I affected?
Affected according to the BSI:
- Zammad Zammad <7.2.1
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Zammad Zammad 7.2.1
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Zammad Release Notes vom 2026-10-05 zammad.com
- GitHub Security Advisory GHSA-23hj-h8w6-rgm3 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-32f8-x62f-599m vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-4r9g-r4wx-44p6 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-5qm6-wgv7-2344 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-7622-vcx5-885g vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-79wh-8g2f-xj2c vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-852x-r9wm-4v5j vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-87pp-7pxh-xfcg vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-8rr9-v56q-rcq9 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-8xp6-vq6v-xrfj vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-f3qr-94c2-7mx2 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-f8x4-5mjf-mc32 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-fhq9-h46w-68hg vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-fqh9-pvgg-jgpw vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-g9f6-7w7h-99f7 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-gvvq-mfj3-g56x vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-h5pm-rjvp-fr47 vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-hpwv-2cr4-rqpf vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-hrpc-pjjc-v9vg vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-jhhg-q69j-35wq vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-jr3g-8mch-9vrf vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-mf8g-36j9-x25g vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-qvmq-j8hm-2mmc vom 2026-10-05 github.com
- GitHub Security Advisory GHSA-r4xq-6xg5-72p7 vom 2026-10-05 github.com
and 3 more sources in the original advisory
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.