CVE-2026-56728

UNKNOWN 0.0

Zammad: Cross-User Taskbar Item Access Control Vulnerability

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. The taskbar feature stores transient state for active user sessions, including auto-saved ticket drafts. Under certain conditions, the authorization check for taskbar item access is not enforced, allowing a user to read another user's taskbar item data. This vulnerability is fixed in 7.0.2.

CWE	CWE-200 CWE-639
Vendor	zammad
Product	zammad
Published	Sep 25, 2026
Last Updated	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for zammad zammad

Be the first to know when new unknown vulnerabilities affecting zammad zammad are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

zammad / zammad

< 7.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zammad/zammad/security/advisories/GHSA-jvcg-5539-vvc3 github.com: https://github.com/zammad/zammad/commit/4ccd5d573023b66b0d0184914c92417e1780793f github.com: https://github.com/zammad/zammad/releases/tag/7.0.2