CVE-2026-56725

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2

Description An unauthenticated remote attacker can cause a denial of service on a production instance. This occurs because the import check and import status actions lack the setup done response guard, allowing them to execute on fully configured instances. A request to the endpoint "/api/v1/import/otrs/import check" triggers a retry loop against a blank OTRS endpoint, blocking a request worker for approximately 115 seconds. Sending a few requests per second can saturate the Puma worker pool, rendering the system unavailable as long as the traffic continues.

Recommendations Update to version 7.0.2.