CVE-2026-56725 – zammad

This Zammad update closes ten flaws in the open source helpdesk platform. Attackers can use them to take over accounts, run commands on the server, delete files, and forge trusted email. The worst flaw is CVE-2026-84458, which has a CVSS score of 9.1, Critical severity. When automatic account linking is on, an attacker who controls any identity at a configured single sign-on provider can log in as any user, administrators included, without that user's password. CVE-2026-84462 has a CVSS score of 8.6, High severity, and lets an administrator who can edit AI Agents run arbitrary commands on the Zammad server. CVE-2026-56733 has a CVSS score of 8.7, High severity, and lets an attacker create new administrator accounts despite token restrictions. CVE-2026-61525 has a CVSS score of 8.8, High severity, and lets a low-privilege user delete arbitrary files and directories through session path traversal. CVE-2026-56725 has a CVSS score of 8.7, High severity, and lets an unauthenticated attacker stall request workers and take a production instance offline.

The remaining flaws break access controls and trust signals. CVE-2026-56723, CVE-2026-56724, and CVE-2026-84464 each have a CVSS score of 7.1, High severity, and let users reach internal attachments, knowledge base items, and ticket, customer, and organization records outside their access scope. CVE-2026-56727 and CVE-2026-84465 each have a CVSS score of 7.1, High severity, and let attackers present tampered or forged PGP and S/MIME email as validly signed. The fixes ship in Zammad versions 7.0.2, 7.0.3, 7.1.0, 7.1.1, and 7.1.2.