Security Flaw in Zammad Helpdesk Software Exposes Users to Email Forgery

CVE-2026-84465

What is CVE-2026-84465?

Zammad, an open-source helpdesk and customer support platform, contains a security flaw that can be exploited for email forgery. Prior to version 7.1.2, the software fails to accurately verify the trustworthiness of digital signatures on incoming S/MIME-signed emails. Instead of validating the signing certificate against a list of trusted authorities, it only checks for the presence of a certificate that matches the sender's name. This allows attackers to create illegitimate certificates and impersonate trusted senders, leading to the display of forged emails marked as validly signed. This vulnerability has been addressed in the recent update.

References