CVE-2026-56726: Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Zammad agent can exploit it, including an agent with no active tickets assigned to them. The issue affects ticket isolation between agents.
What information can an unauthorized agent access?
They can view the titles, status, labels, and URL links of GitHub or GitLab issues attached to tickets elsewhere in the system. The described exposure is limited to integration issue data linked to those tickets.
How would an attacker retrieve data from other tickets?
An authenticated agent can query random or sequential ticket IDs to enumerate GitHub/GitLab issue data linked by other agents or administrators.
Which versions are affected and what is the remediation?
Zammad versions prior to 7.0.2 are affected. Upgrade to version 7.0.2 to obtain the fix.