CVE-2026-56725: Zammad: Denial of Service via OTRS Import Controller
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/importcheck blocks a Zammad request worker for roughly two minutes. The importcheck and importstatus actions are missing the setupdoneresponse guard that other actions in the same controller carry, so they execute on fully set-up production instances. The action enters a retry loop against a blank OTRS endpoint, sleeping for 30 s + 45 s between attempts. Impact An unauthenticated remote attacker denies service to a production Zammad instance. Each request costs almost nothing and forces ~115 seconds of server-side blocking. A few requests per second saturate the Puma worker pool. The condition persists as long as the traffic continues. No account, valid import configuration, or target knowledge beyond the hostname is needed. CSRF token is trivially obtained from any prior GET response. This issue is fixed in version 7.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.0.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Fully set-up production Zammad instances running a version prior to 7.0.2 are exposed because the affected actions execute without the setup-completion guard.
What does an attacker need to exploit this?
An attacker needs only network access to the Zammad hostname. No account, valid OTRS import configuration, or knowledge of a target OTRS endpoint is required; a CSRF token can be obtained from a prior GET response.
How does the denial of service occur?
Requests to the affected import endpoint cause a Zammad request worker to enter retries against a blank OTRS endpoint and block for roughly 115 seconds. A few low-cost requests per second can saturate the Puma worker pool, and the disruption continues while traffic is maintained.
What remediation is available?
Upgrade Zammad to version 7.0.2, which fixes the issue.