Medium severity · published Sep 25, 2026
CVE-2026-56726
Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak
5.1
CVSS
0.3%
EPSS
No
On KEV
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZA
zammad · zammad
< 7.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56726
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56726
github.com
https://github.com/zammad/zammad/commit/c767f32c006ff9842152f78e12f355f7f485304f
github.com
https://github.com/zammad/zammad/commit/e50ef69beab897317caa5e9490edba33aa1ac978
github.com
https://github.com/zammad/zammad/releases/tag/7.0.2
github.com
https://github.com/zammad/zammad/security/advisories/GHSA-96hh-fmj3-h4hp
More from zammad
9.8
CVE-2026-102489
Undisclosed RCE in Zammad v6.3 and higher
7.8
CVE-2026-102490
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
9.8
CVE-2022-48021
A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server
9.8
CVE-2022-35490
Zammad 5.2.0 is vulnerable to privilege escalation
9.8
CVE-2021-42090
An issue was discovered in Zammad before 4.1.1