CVE-2026-56733

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Zammad versions prior to 7.1.0

Description Zammad is a web-based open source helpdesk and customer support system. The issue involves a lack of discursive validation within the authorization cascade, where system-level enforcement of access restrictions during the initialization of new identity objects is inconsistent. Under specific conditions, the granular restrictions of an access key are overridden by the latent authorization authority of the parent account, nullifying the separation of functional areas and expanding administrative discretion. This allows an attacker to bypass token restrictions to create new administrator accounts, granting full access to system data, including tickets, customers, and configuration, leading to complete control of the instance. The flaw arises from a lack of synergy between token-based authorization logic and the functional authorization hierarchy, enabling iterative escalation of the privileged access context.

Recommendations Update to version 7.0.2. Update to version 7.1.0.