CVE-2026-13229: Zammad Auth Bypass Vulnerability

CVE-2026-13229 Overview

CVE-2026-13229 is an authenticated improper authorization vulnerability in Zammad 7.1.0. The flaw resides in the ticket article attachment cloning endpoint. An authenticated user with low privileges can abuse this endpoint to access attachments they should not be able to retrieve. The weakness is classified as Missing Authorization [CWE-862].

The issue was disclosed through a Fluid Attacks security advisory and a coordinated GitHub Security Advisory. Zammad addressed the vulnerability in release 7.1.2.

Critical Impact
Authenticated attackers can clone ticket article attachments across authorization boundaries, resulting in unauthorized disclosure of ticket data that may contain sensitive customer or internal information.

Affected Products

Zammad 7.1.0
Zammad versions prior to 7.1.2
Zammad ticket article attachment cloning endpoint

Discovery Timeline

2026-08-04 - CVE-2026-13229 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-13229

Vulnerability Analysis

Zammad is an open-source helpdesk and ticketing platform. Version 7.1.0 exposes a ticket article attachment cloning endpoint intended to duplicate attachments between tickets or articles. The endpoint fails to enforce authorization checks tying the requesting user to the source attachment's ticket. As a result, any authenticated user can request the cloning operation against attachments belonging to tickets outside their permission scope.

The vulnerability affects confidentiality only. Attackers cannot modify or delete data, and availability is not impacted. However, ticket attachments in helpdesk platforms frequently contain credentials, contracts, personal identifiers, and internal correspondence.

Root Cause

The root cause is a missing authorization check [CWE-862] in the attachment cloning controller. The endpoint verifies that the caller is authenticated but does not verify that the caller has read access to the source ticket or article referenced in the clone request. This is a broken access control pattern where authentication is conflated with authorization.

Attack Vector

The attack requires network access to the Zammad web interface and valid low-privilege credentials, such as a standard agent or customer account depending on deployment configuration. No user interaction is required. The attacker crafts a request to the attachment cloning endpoint referencing an attachment identifier they do not own, and the server processes the clone without verifying ownership.

For exploitation details, refer to the Fluid Attacks Security Advisory and the GitHub Security Advisory GHSA-374g-4f73-g7m7.

// No verified proof-of-concept code is published.
// Refer to the vendor advisory for exploitation details.

Detection Methods for CVE-2026-13229

Indicators of Compromise

Unexpected calls to the Zammad ticket article attachment cloning endpoint from user sessions that do not own the referenced source tickets.
Application logs showing successful attachment clone operations followed by download activity against tickets outside the user's assigned groups.
Anomalous spikes in attachment access volume from a single authenticated session.

Detection Strategies

Enable verbose application logging in Zammad and correlate ticket article attachment clone requests with the requesting user's group membership.
Baseline normal attachment access patterns per agent or customer role and alert on cross-group cloning activity.
Review web server access logs for repeated POST requests to attachment-clone routes referencing sequential or enumerated attachment identifiers.

Monitoring Recommendations

Forward Zammad application and web logs to a centralized SIEM for correlation with identity events.
Monitor for authenticated sessions performing attachment operations at rates inconsistent with normal helpdesk workflows.
Alert on any Zammad instance still running version 7.1.0 or earlier detected during asset inventory scans.

How to Mitigate CVE-2026-13229

Immediate Actions Required

Upgrade Zammad to version 7.1.2 or later without delay. See the Zammad Release 7.1.2 notes.
Audit ticket attachment access logs for the period since deploying 7.1.0 to identify any unauthorized clone operations.
Rotate any credentials, tokens, or secrets that may have been stored in ticket attachments accessible during the exposure window.

Patch Information

Zammad released version 7.1.2 containing the authorization fix. The patch enforces access control validation on the ticket article attachment cloning endpoint, ensuring the requesting user has permission to read the source ticket before cloning. Details are published in the GitHub Security Advisory GHSA-374g-4f73-g7m7 and the upstream GitHub Zammad Repository.

Workarounds

If immediate upgrade is not feasible, restrict access to the Zammad instance to trusted networks using a reverse proxy or firewall rules.
Reduce the number of low-privilege accounts with access to the ticketing system until the patch is applied.
Review and tighten role and group assignments so that agents only have access to the tickets they must handle.

bash

# Upgrade Zammad using the official package manager (Debian/Ubuntu example)
sudo apt update
sudo apt install --only-upgrade zammad
# Verify the installed version is 7.1.2 or later
zammad run rails runner 'puts Zammad::Application::VERSION::STRING'