Improper Access Control in Zammad Helpdesk System

CVE-2026-63205

What is CVE-2026-63205?

Zammad, an open-source helpdesk and customer support system, exhibits an improper access control flaw prior to version 7.1.2. When users create or update email signatures containing inline images that point to existing attachments, the system inadvertently copies these attachments into a new record associated with the signature. This process occurs without validating whether the user has the appropriate permissions to access the original attachment. As a result, users with certain administrative permissions can gain unauthorized access to attachments, including those belonging to tickets or articles they do not have rights to view. This vulnerability was addressed in version 7.1.2, which implements necessary checks to prevent unauthorized attachment access.

References