Unauthorized Access in Zammad Helpdesk System Exposes Sensitive Tag Information

CVE-2026-84460

What is CVE-2026-84460?

Zammad, an open-source helpdesk and customer support platform, contains a flaw that allows authenticated users to access internal tags associated with support tickets without proper authorization. This vulnerability enables users to retrieve sensitive tag information through a REST API endpoint, even for tickets they do not have permission to view. The sequential nature of ticket IDs facilitates bulk enumeration of potential ticket tags. This issue was addressed in version 7.1.2, which restricts unauthorized access.

References