PT-2026-99086 · Zammad · Zammad
CVE-2026-84460
·
Published
2026-09-25
·
Updated
2026-09-25
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Zammad versions prior to 7.1.2
Description
An issue exists where any authenticated user can access the REST endpoint used to retrieve tag lists. This allows the user to obtain tag names for a specific ticket even if they lack the necessary permissions to access that ticket. Because ticket IDs are sequential integers, an attacker can easily perform bulk enumeration to gather sensitive internal categorization labels.
Recommendations
Update to version 7.1.2.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zammad