CVE-2026-56730

UNKNOWN 0.0

Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a knowledge base answer suggestion so it can be inserted into the ticket editor, but it only checks if the user has the ticket.agent permission. Checking the authorization to the knowledge base answer itself is missing. This vulnerability is fixed in 7.0.2.

CWE	CWE-862
Vendor	zammad
Product	zammad
Published	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for zammad zammad

Be the first to know when new unknown vulnerabilities affecting zammad zammad are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

zammad / zammad

< 7.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zammad/zammad/security/advisories/GHSA-pf47-8964-pp23 github.com: https://github.com/zammad/zammad/commit/b059bd1cac36b1eab04cfc0783799e38b8072da7 github.com: https://github.com/zammad/zammad/releases/tag/7.0.2