CVE-2026-56728

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2

Description Broken access control in the GraphQL API allows an authenticated user to access taskbar item data belonging to another user. By crafting a request with the target user's taskbar identifier, an attacker can read transient state data for active user sessions, which may include auto-saved ticket drafts, because the authorization check for taskbar item access is not consistently enforced.

Recommendations Update to version 7.0.2.