CVE-2026-34722: Zammad Auth Bypass Vulnerability

CVE-2026-34722 Overview

CVE-2026-34722 is a Missing Authorization vulnerability affecting Zammad, a web-based open source helpdesk and customer support system. The vulnerability exists in the ticket creation endpoint, which fails to properly enforce authorization checks when the related parameter for adding links is used. This allows unauthorized users to potentially manipulate ticket links without proper authentication or authorization controls.

Critical Impact

Unauthorized access to ticket linking functionality could allow attackers to associate malicious or misleading links with support tickets, potentially compromising ticket integrity and customer support operations.

Affected Products

• Zammad versions prior to 7.0.1
• Zammad versions prior to 6.5.4

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-34722 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-34722

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the affected endpoint does not properly verify that users have the required permissions before allowing ticket link operations. In a properly secured application, all endpoints that modify or create resources should verify both authentication (is the user who they claim to be?) and authorization (does this user have permission to perform this action?).

The vulnerable ticket creation endpoint accepts a parameter for adding links to tickets. When this parameter is supplied, the authorization check that would normally validate user permissions is bypassed or missing entirely. This architectural flaw allows unauthenticated or unauthorized users to add links to tickets they should not have access to.

Root Cause

The root cause of this vulnerability is the absence of proper authorization middleware or checks on the ticket creation endpoint when the link-adding parameter is utilized. The application fails to validate that the requesting user has the necessary permissions to add links to tickets, violating the principle of least privilege.

This is a common pattern in web applications where certain parameters or features are added to existing endpoints without ensuring that all code paths enforce consistent authorization policies. The link-adding functionality appears to have been implemented without integrating the authorization checks present elsewhere in the ticketing system.

Attack Vector

The attack leverages network-accessible API endpoints without requiring user interaction. An attacker can craft HTTP requests to the ticket creation endpoint with the link parameter included. Since no authentication or authorization is required when this specific parameter is used, the attacker can:

1. Identify the vulnerable ticket creation endpoint
2. Submit requests with the link-adding parameter populated
3. Associate arbitrary links with tickets without authorization
4. Potentially manipulate ticket data or inject malicious content into the helpdesk system

The vulnerability can be exploited remotely over the network with low attack complexity and requires no privileges or user interaction, though the impact is limited to confidentiality and integrity concerns rather than full system compromise.

Detection Methods for CVE-2026-34722

Indicators of Compromise

• Unusual API requests to ticket creation endpoints containing link parameters from unauthenticated sessions
• Unexpected links appearing on tickets without corresponding authorized user activity
• HTTP requests to the ticket creation API endpoint from suspicious IP addresses or without valid session tokens
• Anomalous ticket modification patterns in Zammad audit logs

Detection Strategies

• Monitor HTTP access logs for requests to ticket creation endpoints that include link parameters without proper authentication headers
• Implement web application firewall (WAF) rules to detect and alert on suspicious ticket API activity
• Review Zammad application logs for ticket link operations performed by unauthenticated or unauthorized users
• Deploy API monitoring tools to track unusual patterns in ticket creation and modification requests

Monitoring Recommendations

• Enable verbose logging for all ticket-related API endpoints in Zammad
• Set up alerting for failed authorization attempts and unusual API access patterns
• Regularly audit ticket links and associations for unauthorized modifications
• Implement rate limiting on ticket creation endpoints to mitigate automated exploitation attempts

How to Mitigate CVE-2026-34722

Immediate Actions Required

• Upgrade Zammad to version 7.0.1 or 6.5.4 immediately to address this vulnerability
• Review ticket link data for any unauthorized modifications that may have occurred prior to patching
• Audit API access logs for signs of exploitation
• Consider temporarily restricting access to ticket creation functionality via network controls until patching is complete

Patch Information

Zammad has released security patches addressing this vulnerability. Organizations running affected versions should upgrade to:

• Version 7.0.1 for users on the 7.x branch
• Version 6.5.4 for users on the 6.5.x branch

For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict API endpoint access to trusted IP ranges
• Deploy a web application firewall (WAF) to filter and monitor requests to ticket creation endpoints
• Review and harden authentication mechanisms for all API endpoints as a defense-in-depth measure
• Consider implementing additional authorization checks at the reverse proxy or API gateway level

# Example: Restrict access to Zammad API endpoints via nginx
location /api/v1/tickets {
    # Allow only authenticated requests from trusted networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Ensure requests have valid auth headers
    if ($http_authorization = "") {
        return 401;
    }
    
    proxy_pass http://zammad_backend;
}