CSRF Vulnerability in Zammad Helpdesk System
CVE-2026-34721

5.9MEDIUM

Key Information:

Vendor

Zammad

Status
Zammad
Vendor
CVE Published:
8 April 2026

What is CVE-2026-34721?

Zammad, an open-source helpdesk and customer support system, has a vulnerability that affects its OAuth callback endpoints for Microsoft, Google, and Facebook. The issue arises from the lack of validation for the CSRF state parameter in versions prior to 7.0.1 and 6.5.4. This flaw could potentially allow an attacker to exploit the system by tricking users into making unauthorized requests. Users are advised to upgrade to the latest versions to mitigate this risk. More details can be found in the advisory linked below.

Affected Version(s)

zammad < 6.5.4 < 6.5.4

zammad >= 7.0.0-alpha, < 7.0.1 < 7.0.0-alpha, 7.0.1

References

https://github.com/zammad/zammad/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.