Authorization Flaw in Zammad Helpdesk System

CVE-2026-56733

What is CVE-2026-56733?

Zammad, a web-based open-source helpdesk solution, has a significant flaw in its authorization process prior to version 7.0.2 and 7.1.0. This vulnerability arises from inadequate validation during the initialization of new identity objects, leading to a situation where access restrictions can be overridden by the parent account's authority. Consequently, this means that attackers can exploit this gap to create new administrator accounts, gaining full access to system data including tickets and customer information. The issue is rooted in a mismatch between token-based authorization and the system's intended authorization framework, allowing an escalation of privileges that undermines data integrity and control. To mitigate these risks, it's critical for users to update to the secured versions 7.0.2 or 7.1.0 and conduct a thorough review of their authorization structures.

References