CVE-2026-61855: Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid ("Good") PGP signature from a registered sender key, even though the displayed message content is not actually covered by that signature. As a result, the inbound article may be stored with a successful signature status that does not reflect the authenticity of the shown content. This can mislead agents who rely on the signature indicator when assessing the trustworthiness of incoming mail. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects Zammad versions 7.0.3 and 7.1.1 when processing inbound PGP-signed email under certain conditions. Version 7.1.2 contains the fix.
What does an attacker need to do to exploit this?
An attacker would need to send an inbound email whose detached PGP signature is evaluated as valid for a registered sender key while the message content displayed to agents is not covered by that signature. The impact is misleading agents into trusting content based on an inaccurate successful-signature status.
How can administrators tell whether they may be affected?
Review the deployed Zammad version and whether agents rely on PGP signature indicators for inbound email. Systems running 7.0.3 or 7.1.1 may record a successful signature status for displayed content that was not actually authenticated by the signature.