CVE-2026-84460

UNKNOWN 0.0

Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2.

CWE	CWE-639
Vendor	zammad
Product	zammad
Published	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for zammad zammad

Be the first to know when new unknown vulnerabilities affecting zammad zammad are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

zammad / zammad

< 7.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zammad/zammad/security/advisories/GHSA-6vgm-xxp4-p6jv github.com: https://github.com/zammad/zammad/commit/13217eb6b3fdf350228b13f8cf69f640b8fd0da2 github.com: https://github.com/zammad/zammad/commit/d1a5eabdd1285b202f75761c4406edc5509e217e