CVE-2026-84460: Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Zammad user can exploit it. The user does not need access to the ticket whose tags they request.
What information can be exposed?
The affected REST endpoint returns tag names associated with a specified ticket. Because tags can contain sensitive internal categorization labels, this can disclose information about otherwise inaccessible tickets.
Why is bulk exploitation practical?
Ticket IDs are sequential integers, so an authenticated user can iterate through ticket IDs and request tags for many tickets.
Are default deployments affected?
The issue affects Zammad versions before 7.1.2 where authenticated users can access the tag-list REST endpoint. No additional configuration requirement is identified in the provided information.
How can this be remediated?
Upgrade Zammad to version 7.1.2, which fixes the authorization issue in the tag-list endpoint.