CVE-2026-34248: Zammad has an information disclosure in ticket detail view of customers in shared organizations
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34248?
CVE-2026-34248 has a medium severity rating due to the potential information disclosure issues.
How do I fix CVE-2026-34248?
To fix CVE-2026-34248, upgrade Zammad to version 7.0.1 or later.
What causes CVE-2026-34248?
CVE-2026-34248 is caused by improper access control allowing customers in shared organizations to view restricted ticket details.
Who is affected by CVE-2026-34248?
CVE-2026-34248 affects users of Zammad versions prior to 7.0.1, particularly those in shared organizations.
What are the implications of CVE-2026-34248?
The implications of CVE-2026-34248 include unauthorized access to sensitive ticket information among customers in shared organizations.