CVE-2026-56734: Zammad: Avatar Image URL Server-Side Request Forwarding
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider may cause the server to connect to internal network locations. Response timing and error patterns differ between reachable and unreachable targets, allowing internal service probing. Worker processes may be blocked for several seconds per request. Requires a configured external authentication provider where the actor can modify their profile image URL. This issue is fixed in version 7.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.0.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using a Zammad version prior to 7.0.2 with federated OAuth, OIDC, or SAML authentication configured are exposed when users of the connected identity provider can modify their profile image URL.
What does an attacker need to exploit this issue?
The attacker needs an account at a configured external identity provider and the ability to control that account's profile image URL. They can use that URL to cause the Zammad server to make requests to internal network locations.
What is the practical impact of exploitation?
Differences in response timing and errors for reachable versus unreachable targets can allow internal service probing. Requests can also block worker processes for several seconds each.
How can this be remediated?
Upgrade Zammad to version 7.0.2, which fixes the issue.