Information Disclosure in Zammad Helpdesk System by Unauthorized Users

CVE-2026-63204

What is CVE-2026-63204?

In the Zammad Helpdesk System, prior to version 7.1.2, a vulnerability exists that allows an authenticated user with agent permissions to interact with the ticket summarize endpoint. By supplying a specific AI analytics run identifier, the agent can retrieve AI provider error messages related to that identifier, even if they do not have access to the corresponding ticket. This exposure is limited to the error string from the API and does not include any ticket content, which remains secure. Zammad has addressed this issue in version 7.1.2, enhancing the security of user access to sensitive information.

References