CVE-2026-84465: Zammad: S/MIME signature verification allows forged sender impersonation
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is already stored in the system. An attacker can create their own certificate using the name of a real, previously trusted sender and use it to send a forged email. Zammad will display that email with the same "validly signed" indicator as a genuine message from the real sender, even though the attacker never had access to that sender's actual certificate or private key. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Which deployments are affected?
Zammad versions prior to 7.1.2 are affected when they process incoming S/MIME-signed email. The issue depends on Zammad having a certificate stored for the name the attacker impersonates.
What does an attacker need to exploit this?
The attacker needs to create an S/MIME certificate using the name of a real sender whose certificate is already stored in Zammad, then send a signed forged email. They do not need access to the legitimate sender's certificate or private key.
How can teams tell whether a message may have been spoofed?
In affected versions, the valid-signature indicator cannot distinguish a genuinely trusted signing certificate from an attacker-created certificate with a matching name. Messages shown as validly signed should therefore not be treated as proof of sender identity.
What should be done if upgrading cannot happen immediately?
Treat S/MIME validity indicators on incoming email as unreliable for identity verification, particularly for senders with stored certificates. Verify sensitive requests through an independent communication channel until Zammad can be updated to 7.1.2.