CVE-2026-65828: Zammad: Pending upload deletion bypass via legacy attachment endpoint
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroyform action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied formid without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and must know another user's pending-upload UUID. The impact is limited to deleting the victim's temporary uploads before the victim submits a ticket or article.
Which deployments are affected and what version fixes it?
Zammad versions prior to 7.1.2 are affected through the legacy AttachmentsController destroy_form action. Upgrading to version 7.1.2 fixes the ownership verification issue.
How can we tell whether an attempted attack occurred?
The provided information does not identify specific logs, events, or indicators for detecting exploitation. Affected users may observe that files uploaded for a not-yet-submitted ticket or article disappear before submission.