CVE-2026-34722: Zammad Auth Bypass Vulnerability

CVE-2026-34722 Overview

CVE-2026-34722 is a Missing Authorization vulnerability affecting Zammad, a web-based open source helpdesk and customer support system. The vulnerability exists in the ticket creation endpoint, which fails to properly enforce authorization checks when the related parameter for adding links is used. This allows unauthorized users to potentially manipulate ticket links without proper authentication or authorization controls.

Critical Impact
Unauthorized access to ticket linking functionality could allow attackers to associate malicious or misleading links with support tickets, potentially compromising ticket integrity and customer support operations.

Affected Products

Zammad versions prior to 7.0.1
Zammad versions prior to 6.5.4

Discovery Timeline

2026-04-08 - CVE CVE-2026-34722 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-34722

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the affected endpoint does not properly verify that users have the required permissions before allowing ticket link operations. In a properly secured application, all endpoints that modify or create resources should verify both authentication (is the user who they claim to be?) and authorization (does this user have permission to perform this action?).

The vulnerable ticket creation endpoint accepts a parameter for adding links to tickets. When this parameter is supplied, the authorization check that would normally validate user permissions is bypassed or missing entirely. This architectural flaw allows unauthenticated or unauthorized users to add links to tickets they should not have access to.

Root Cause

The root cause of this vulnerability is the absence of proper authorization middleware or checks on the ticket creation endpoint when the link-adding parameter is utilized. The application fails to validate that the requesting user has the necessary permissions to add links to tickets, violating the principle of least privilege.

This is a common pattern in web applications where certain parameters or features are added to existing endpoints without ensuring that all code paths enforce consistent authorization policies. The link-adding functionality appears to have been implemented without integrating the authorization checks present elsewhere in the ticketing system.

Attack Vector

The attack leverages network-accessible API endpoints without requiring user interaction. An attacker can craft HTTP requests to the ticket creation endpoint with the link parameter included. Since no authentication or authorization is required when this specific parameter is used, the attacker can:

Identify the vulnerable ticket creation endpoint
Submit requests with the link-adding parameter populated
Associate arbitrary links with tickets without authorization
Potentially manipulate ticket data or inject malicious content into the helpdesk system

The vulnerability can be exploited remotely over the network with low attack complexity and requires no privileges or user interaction, though the impact is limited to confidentiality and integrity concerns rather than full system compromise.

Detection Methods for CVE-2026-34722

Indicators of Compromise

Unusual API requests to ticket creation endpoints containing link parameters from unauthenticated sessions
Unexpected links appearing on tickets without corresponding authorized user activity
HTTP requests to the ticket creation API endpoint from suspicious IP addresses or without valid session tokens
Anomalous ticket modification patterns in Zammad audit logs

Detection Strategies

Monitor HTTP access logs for requests to ticket creation endpoints that include link parameters without proper authentication headers
Implement web application firewall (WAF) rules to detect and alert on suspicious ticket API activity
Review Zammad application logs for ticket link operations performed by unauthenticated or unauthorized users
Deploy API monitoring tools to track unusual patterns in ticket creation and modification requests

Monitoring Recommendations

Enable verbose logging for all ticket-related API endpoints in Zammad
Set up alerting for failed authorization attempts and unusual API access patterns
Regularly audit ticket links and associations for unauthorized modifications
Implement rate limiting on ticket creation endpoints to mitigate automated exploitation attempts

How to Mitigate CVE-2026-34722

Immediate Actions Required

Upgrade Zammad to version 7.0.1 or 6.5.4 immediately to address this vulnerability
Review ticket link data for any unauthorized modifications that may have occurred prior to patching
Audit API access logs for signs of exploitation
Consider temporarily restricting access to ticket creation functionality via network controls until patching is complete

Patch Information

Zammad has released security patches addressing this vulnerability. Organizations running affected versions should upgrade to:

Version 7.0.1 for users on the 7.x branch
Version 6.5.4 for users on the 6.5.x branch

For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

Implement network-level access controls to restrict API endpoint access to trusted IP ranges
Deploy a web application firewall (WAF) to filter and monitor requests to ticket creation endpoints
Review and harden authentication mechanisms for all API endpoints as a defense-in-depth measure
Consider implementing additional authorization checks at the reverse proxy or API gateway level

bash

# Example: Restrict access to Zammad API endpoints via nginx
location /api/v1/tickets {
    # Allow only authenticated requests from trusted networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Ensure requests have valid auth headers
    if ($http_authorization = "") {
        return 401;
    }
    
    proxy_pass http://zammad_backend;
}