CVE-2026-34782: Zammad Auth Bypass Vulnerability

CVE-2026-34782 Overview

CVE-2026-34782 is a Missing Authorization vulnerability (CWE-862) in Zammad, a web-based open source helpdesk and customer support system. Prior to versions 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id fails to properly verify whether a user has the necessary privileges to access and use the text tool functionality. This broken access control allows authenticated users to invoke AI text assistance tools in all situations, regardless of their assigned permission level.

Critical Impact

Authenticated users can bypass authorization checks to access AI-powered text tools, potentially exposing sensitive helpdesk data or manipulating content beyond their authorized scope.

Affected Products

• Zammad versions prior to 7.0.1
• Zammad versions prior to 6.5.4

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-34782 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-34782

Vulnerability Analysis

This vulnerability represents a Missing Authorization flaw where the Zammad application fails to enforce proper privilege checks on a REST API endpoint. The affected endpoint /api/v1/ai_assistance/text_tools/:id handles AI-powered text assistance functionality, which should only be accessible to users with appropriate permissions.

The root issue lies in the endpoint handler accepting and processing requests from any authenticated user without validating whether they possess the requisite privileges for the specific text tool being invoked. This allows lower-privileged users to access functionality that should be restricted to administrators or users with elevated permissions.

Root Cause

The vulnerability stems from missing authorization logic in the POST /api/v1/ai_assistance/text_tools/:id endpoint. The API controller processes requests based solely on authentication status without implementing proper role-based access control (RBAC) checks. This is a classic example of CWE-862 (Missing Authorization), where the application authenticates users but fails to verify they are authorized to perform the requested action.

Attack Vector

An attacker with valid low-privilege credentials to a Zammad instance can exploit this vulnerability by sending crafted HTTP POST requests directly to the vulnerable API endpoint. The attack vector is network-based and requires no user interaction beyond the attacker having authenticated access to the system.

The exploitation flow involves:

1. Authenticating to Zammad with any valid user account
2. Sending POST requests to /api/v1/ai_assistance/text_tools/:id with various tool IDs
3. Accessing AI text assistance functionality without proper privilege verification

For technical details regarding the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-34782

Indicators of Compromise

• Unusual volume of POST requests to /api/v1/ai_assistance/text_tools/:id from low-privilege user accounts
• Access logs showing AI text tool invocations from users who should not have permissions to use these features
• API audit logs revealing text tool endpoint access patterns inconsistent with user role assignments

Detection Strategies

• Implement API endpoint monitoring to track all requests to the /api/v1/ai_assistance/text_tools/ path
• Correlate API access logs with user permission databases to identify unauthorized access attempts
• Deploy web application firewall (WAF) rules to log and alert on suspicious patterns targeting the vulnerable endpoint
• Review Zammad application logs for anomalous AI assistance feature usage

Monitoring Recommendations

• Enable detailed logging for all API endpoints, particularly those related to AI assistance features
• Set up alerting for requests to text tool endpoints from users without explicit permissions
• Monitor for privilege escalation patterns where users access features beyond their assigned roles
• Implement real-time correlation between authentication events and subsequent API activity

How to Mitigate CVE-2026-34782

Immediate Actions Required

• Upgrade Zammad installations to version 7.0.1 or 6.5.4 immediately
• Review API access logs for evidence of exploitation prior to patching
• Audit user access to AI text tool features to identify any unauthorized usage
• Restrict network access to Zammad instances until patches can be applied

Patch Information

Zammad has released patched versions that address this authorization bypass vulnerability. Organizations should update to:

• Version 7.0.1 for installations on the 7.x branch
• Version 6.5.4 for installations on the 6.x branch

The security advisory is available at the GitHub Security Advisory for GHSA-96r7-29c8-2j7q.

Workarounds

• Implement network-level access controls to restrict who can reach the Zammad API endpoints
• Use a reverse proxy or WAF to block or rate-limit requests to /api/v1/ai_assistance/text_tools/ until patching is complete
• Disable AI assistance features entirely if not critical to operations until the update can be applied
• Implement additional authentication layers such as IP allowlisting for administrative functions

# Example: Nginx configuration to temporarily block the vulnerable endpoint
location ~* /api/v1/ai_assistance/text_tools {
    # Allow only trusted admin IPs
    allow 192.168.1.0/24;
    deny all;
    
    # Or return 403 for all requests until patched
    # return 403;
    
    proxy_pass http://zammad_backend;
}