Authorization Flaw in Zammad Helpdesk System Exposes User Data

CVE-2026-34837

What is CVE-2026-34837?

The Zammad Helpdesk System prior to version 7.0.1 contains an authorization flaw within its REST endpoint POST /api/v1/ai_assistance/text_tools/:id. This issue allows unauthorized users to access and utilize context data, such as group or organization information, when generating AI prompts. Specifically, the permissions required (ticket.agent) to access this context data were not properly enforced, potentially exposing sensitive information to users without the necessary authorizations. The vulnerability has been resolved in version 7.0.1, highlighting the importance of keeping the software updated to mitigate security risks.

References