CVE-2025-32359: High severity zammad vulnerability
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32359?
CVE-2025-32359 has been classified as a high-severity vulnerability due to its impact on the integrity of two-factor authentication configurations.
How do I fix CVE-2025-32359?
To fix CVE-2025-32359, upgrade Zammad to version 6.4.2 or later where the vulnerability has been addressed.
What impact does CVE-2025-32359 have on user authentication?
CVE-2025-32359 allows unauthorized users to change two-factor authentication settings without re-authentication, potentially leading to account takeover.
Which versions of Zammad are affected by CVE-2025-32359?
CVE-2025-32359 affects Zammad versions 6.4.0 through 6.4.1.
Is there a workaround for CVE-2025-32359 until I can update?
There are no official workarounds for CVE-2025-32359; immediate upgrading to a secure version is strongly recommended.