ZA
Product
zammad
On CISA KEVExploited in the wild
123
CVEs
2
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 12High 32Medium 75Low 4
Watch
Add zammad to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-84461 | 6.9 | Sep 25 | Zammad: Missing rate limiting allows password brute-forcing during two-factor login Affected: < 7.1.2 |
| CVE-2026-63207 | 6.9 | Sep 25 | Zammad: Sensitive Information Exposure in Integration Administration API Affected: < 7.1.2 |
| CVE-2024-36078 | 6.7 | May 19 | In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions Affected: 6.3.0; 6.3.0 |
| CVE-2026-34721 | 6.5 | Apr 8 | Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints Affected: < 6.5.4; >= 7.0.0-alpha, < 7.0.1 |
| CVE-2024-33667 | 6.5 | Apr 26 | An issue was discovered in Zammad before 6.3.0 Affected: 6.2.0 before 6.3.0; 6.3.0 |
| CVE-2023-31597 | 6.5 | May 18 | An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user Affected: before 5.4.1 |
| CVE-2023-29868 | 6.5 | May 2 | Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control Affected: 5.3.0 before 5.4.0 |
| CVE-2023-29867 | 6.5 | May 2 | Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control Affected: 5.3.0 before 5.4.0 |
| CVE-2022-40816 | 6.5 | Sep 27 | Zammad 5.2.1 is vulnerable to Incorrect Access Control Affected: 5.2.0 before 5.2.2 |
| CVE-2022-35489 | 6.5 | Aug 8 | In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned Affected: 5.2.0; 5.2.0 |
| CVE-2021-42084 | 6.5 | Oct 7 | An issue was discovered in Zammad before 4.1.1 Affected: before 4.1.1 |
| CVE-2020-26029 | 6.5 | Dec 28 | An issue was discovered in Zammad before 3.4.1 Affected: 1.0.0 before 3.4.1 |
| CVE-2020-14214 | 6.5 | Jun 16 | Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions Affected: before 3.3.1 |
| CVE-2020-10100 | 6.5 | Mar 5 | An issue was discovered in Zammad 3.0 through 3.2 Affected: 1.0.0 through 3.2.0 |
| CVE-2026-84463 | 6.3 | Sep 25 | Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute Affected: < 7.1.2 |
| CVE-2026-34718 | 6.1 | Apr 8 | Zammad improperly neutralizes of script-related HTML tags in ticket articles Affected: < 6.5.4; >= 7.0.0-alpha, < 7.0.1 |
| CVE-2021-42088 | 6.1 | Oct 7 | An issue was discovered in Zammad before 4.1.1 Affected: before 4.1.1 |
| CVE-2021-35303 | 6.1 | Jun 28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute Affected: 1.0.0 through 4.0.0 |
| CVE-2021-35298 | 6.1 | Jun 28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store… Affected: 1.0.0 through 4.0.0 |
| CVE-2019-1010018 | 6.1 | Jul 16 | Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80 Affected: 2.1.0 through 2.1.2; 2.2.0 through 2.2.1; 2.3.0 |
| CVE-2018-1000154 | 6.1 | Apr 5 | Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are… Affected: through 2.3.0 |
| CVE-2017-5621 | 6.1 | Mar 13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1 Affected: through 1.0.3; 1.1.0; 1.1.1; 1.1.2; 1.2.0 |
| CVE-2017-5620 | 6.1 | Mar 13 | An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1 Affected: through 1.0.3; 1.1.0; 1.1.1; 1.1.2; 1.2.0 |
| CVE-2023-50454 | 5.9 | Dec 10 | An issue was discovered in Zammad before 6.2.0 Affected: 6.1.0; 6.1.0; 6.2.0 |
| CVE-2026-34248 | 5.7 | Apr 8 | Zammad has an information disclosure in ticket detail view of customers in shared organizations Affected: >= 7.0.0, < 7.0.1 |
| CVE-2021-42085 | 5.4 | Oct 7 | An issue was discovered in Zammad before 4.1.1 Affected: before 4.1.1 |
| CVE-2021-42092 | 5.4 | Oct 7 | An issue was discovered in Zammad before 4.1.1 Affected: before 4.1.1 |
| CVE-2020-26035 | 5.4 | Dec 28 | An issue was discovered in Zammad before 3.4.1 Affected: 1.0.0 before 3.4.1 |
| CVE-2020-26033 | 5.4 | Dec 28 | An issue was discovered in Zammad before 3.4.1 Affected: 1.0.0 before 3.4.1 |
| CVE-2020-14213 | 5.4 | Jun 16 | In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge) Affected: before 3.3.1 |
| CVE-2020-10103 | 5.4 | Mar 5 | An XSS issue was discovered in Zammad 3.0 through 3.2 Affected: 1.0.0 through 3.2.0 |
| CVE-2020-10099 | 5.4 | Mar 5 | An XSS issue was discovered in Zammad 3.0 through 3.2 Affected: 1.0.0 through 3.2.0 |
| CVE-2020-10098 | 5.4 | Mar 5 | An XSS issue was discovered in Zammad 3.0 through 3.2 Affected: 1.0.0 through 3.2.0 |
| CVE-2026-63006 | 5.3 | Sep 25 | Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset Affected: < 7.1.2 |
| CVE-2026-61855 | 5.3 | Sep 25 | Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail Affected: < 7.1.2 |
| CVE-2026-63216 | 5.3 | Sep 25 | Zammad: Stored XSS via unescaped option labels in the object attribute options context UI Affected: < 7.1.2 |
| CVE-2026-84460 | 5.3 | Sep 25 | Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration Affected: < 7.1.2 |
| CVE-2026-63206 | 5.3 | Sep 25 | Zammad: Remote image tracking bypass via shortened URL scheme Affected: < 7.1.2 |
| CVE-2026-56728 | 5.3 | Sep 25 | Zammad: Cross-User Taskbar Item Access Control Vulnerability Affected: < 7.0.2 |
| CVE-2026-56732 | 5.3 | Sep 25 | Zammad: Malicious input in Ticket Body Enables Session Termination Affected: < 7.0.2 |
| CVE-2026-56735 | 5.3 | Sep 25 | Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad Affected: < 7.0.2 |
| CVE-2026-56734 | 5.3 | Sep 25 | Zammad: Avatar Image URL Server-Side Request Forwarding Affected: < 7.0.2 |
| CVE-2023-50456 | 5.3 | Dec 10 | An issue was discovered in Zammad before 6.2.0 Affected: 6.1.0; 6.1.0; 6.2.0 |
| CVE-2023-50453 | 5.3 | Dec 10 | An issue was discovered in Zammad before 6.2.0 Affected: 6.1.0; 6.1.0; 6.2.0 |
| CVE-2021-44886 | 5.3 | Feb 4 | In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons Affected: 5.0.2 |
| CVE-2021-42137 | 5.3 | Oct 11 | An issue was discovered in Zammad before 5.0.1 Affected: before 5.0.1 |
| CVE-2021-35302 | 5.3 | Jun 28 | Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information Affected: 1.0.0 through 4.0.0 |
| CVE-2021-35301 | 5.3 | Jun 28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view Affected: 1.0.0 through 4.0.0 |
| CVE-2020-10105 | 5.3 | Mar 5 | An issue was discovered in Zammad 3.0 through 3.2 Affected: 1.0.0 through 3.2.0 |
| CVE-2020-10102 | 5.3 | Mar 5 | An issue was discovered in Zammad 3.0 through 3.2 Affected: 1.0.0 through 3.2.0 |