Information Disclosure in Zammad Web-Based Helpdesk System

CVE-2026-56729

What is CVE-2026-56729?

In the Zammad web-based helpdesk system, prior to version 7.0.2, an information disclosure vulnerability exists. Users assigned as knowledge_base.editors in one category can access answer titles and update timestamps from other categories they do not have permission to view. While category names remain undisclosed and accessing the content results in a 'Page not found' message, the exposure of answer titles alone poses a risk of revealing sensitive information. This issue has been addressed in version 7.0.2.

References