CVE-2026-34837: Zammad Auth Bypass Vulnerability

CVE-2026-34837 Overview

CVE-2026-34837 is an authorization bypass vulnerability in Zammad, a popular web-based open source helpdesk and customer support system. The vulnerability exists in the REST endpoint POST /api/v1/ai_assistance/text_tools/:id, where context data such as group or organization information supplied to AI prompts is not properly validated against user permissions. This missing authorization check allows authenticated users with ticket.agent permission to access and use context data they should not be authorized to view.

Critical Impact

Authenticated attackers with ticket.agent permission can extract sensitive group and organization data through AI assistance functionality by injecting unauthorized context data into AI prompts.

Affected Products

• Zammad versions prior to 7.0.1

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-34837 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-34837

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a broken access control issue that occurs when an application fails to perform authorization checks on critical functionality. In Zammad's AI assistance feature, the /api/v1/ai_assistance/text_tools/:id endpoint accepts context data parameters that specify groups, organizations, or other entities to be included in AI-generated prompts.

The core flaw is that while the endpoint requires the user to have ticket.agent permission to access the AI text tools feature, it does not validate whether the authenticated user has permission to access the specific context data being supplied. This creates an authorization gap where an agent can reference and extract data from groups or organizations outside their authorized scope.

The attack surface is network-accessible, requiring low attack complexity since the attacker only needs valid credentials with ticket.agent permissions. The vulnerability primarily impacts confidentiality by allowing unauthorized data access through the AI prompt mechanism.

Root Cause

The root cause is a missing authorization check in the AI assistance text tools controller. When processing context data for AI prompts, the application accepts group IDs, organization IDs, or other entity references without verifying that the current user has read access to those entities. The authorization logic only validates that the user has the ticket.agent permission to use the AI feature, but fails to apply object-level authorization to the context data parameters.

Attack Vector

The attack vector involves an authenticated user with ticket.agent permission sending crafted API requests to the AI assistance endpoint with context data referencing groups or organizations they should not have access to. By manipulating the context parameters in the POST request, an attacker can cause sensitive information from unauthorized entities to be included in the AI prompt processing, potentially exposing that data in the AI-generated response.

The attack requires network access and a valid authenticated session with at least ticket.agent permissions. No user interaction is required, and the attacker can systematically enumerate and extract data from various groups and organizations across the Zammad instance.

Detection Methods for CVE-2026-34837

Indicators of Compromise

• Unusual API activity targeting /api/v1/ai_assistance/text_tools/:id endpoints
• AI assistance requests containing context data references to multiple groups or organizations
• Access patterns showing agents querying data outside their assigned group scope
• Audit logs revealing AI text tool usage with elevated data access patterns

Detection Strategies

• Monitor API access logs for POST requests to /api/v1/ai_assistance/text_tools/ endpoints
• Implement application-layer logging to track context data parameters in AI assistance requests
• Create alerts for agents accessing AI tools with context data outside their permission scope
• Review audit trails for bulk or automated requests to AI assistance endpoints

Monitoring Recommendations

• Enable comprehensive API request logging including request body parameters
• Implement rate limiting on AI assistance endpoints to detect enumeration attempts
• Configure SIEM rules to correlate AI assistance usage with user permission levels
• Establish baseline usage patterns for AI text tools to identify anomalous behavior

How to Mitigate CVE-2026-34837

Immediate Actions Required

• Upgrade Zammad to version 7.0.1 or later immediately
• Review audit logs for suspicious AI assistance API activity prior to patching
• Assess whether sensitive group or organization data may have been exposed
• Consider temporarily disabling AI assistance features if immediate patching is not possible

Patch Information

Zammad has released version 7.0.1 which addresses this authorization bypass vulnerability. The fix implements proper authorization checks on context data supplied to the AI assistance text tools endpoint, ensuring users can only reference data they are permitted to access. Administrators should upgrade to this version as soon as possible.

For detailed patch information, refer to the GitHub Security Advisory GHSA-89vv-6639-wcv8.

Workarounds

• Restrict access to the AI assistance feature by limiting ticket.agent permissions to trusted users only
• Implement network-level access controls to limit API access to trusted networks
• Use a web application firewall (WAF) to monitor and filter requests to AI assistance endpoints
• Temporarily disable AI assistance functionality via configuration until patching is complete

# Verify Zammad version after patching
zammad version
# Expected output should show 7.0.1 or higher