Client-Side Security Flaw in Zammad Helpdesk Software

CVE-2025-32359

What is CVE-2025-32359?

Zammad versions 6.4.x prior to 6.4.2 exhibit a significant security flaw where client-side enforcement of security settings fails. When users modify their two-factor authentication settings, they are required to re-authenticate using their current password. However, this requirement is only enforced on the client-side interface and does not extend to direct API interactions. This oversight may allow attackers to exploit the API without proper authentication, potentially compromising user accounts and sensitive information.

References