CVE-2026-34837: Zammad is miissing authorization in AI assistance controller for context data used in text tools
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/aiassistance/texttools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.0.1 - Configuration
Ensure the user has the required "ticket.agent" permission so they can access/use the context data provided to AI prompts via the REST endpoint POST /api/v1/ai_assistance/text_tools/:id.
Zammad AI assistance (text tools) ticket.agent permission = required
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34837?
The severity of CVE-2026-34837 is considered significant due to unauthorized access to context data in the AI assistance controller.
How do I fix CVE-2026-34837?
To fix CVE-2026-34837, upgrade Zammad to version 7.0.1 or later where the authorization vulnerability is resolved.
What versions of Zammad are affected by CVE-2026-34837?
Zammad versions before 7.0.1, including 7.0.0, are affected by CVE-2026-34837.
What specific endpoint is vulnerable in CVE-2026-34837?
The specific endpoint vulnerable in CVE-2026-34837 is the POST /api/v1/ai_assistance/text_tools/:id.
What kind of vulnerability does CVE-2026-34837 represent?
CVE-2026-34837 represents an authorization failure leading to sensitive context data exposure.