CVE-2026-56724: Zammad Privilege Escalation Vulnerability

CVE-2026-56724 Overview

Zammad is a web-based open source helpdesk and customer support system used by organizations to manage support tickets and knowledge bases. CVE-2026-56724 is a broken access control vulnerability [CWE-639] in the knowledge base management area of Zammad versions prior to 7.0.2. Permission checks and data validation for linked items were not fully enforced, allowing authenticated users with limited read permissions to interact with items outside their assigned access scope. The issue is fixed in version 7.0.2 through additional validation routines applied to knowledge base attachment operations.

Critical Impact
Authenticated users with low privileges can read, create, or delete knowledge base answer attachments that fall outside their authorized access scope, resulting in unauthorized disclosure or modification of restricted content.

Affected Products

Zammad helpdesk and customer support system
All releases prior to version 7.0.2
Deployments exposing the knowledge base editor API endpoints

Discovery Timeline

2026-09-25 - CVE-2026-56724 published to the National Vulnerability Database
2026-09-28 - Last updated in NVD database
Version 7.0.2 - Zammad released the patched version containing the access control fix

Technical Details for CVE-2026-56724

Vulnerability Analysis

The vulnerability resides in the Zammad knowledge base answer attachments controller. The original policy class Controllers::KnowledgeBase::Answer::AttachmentsControllerPolicy granted access to all authenticated users assigned the broad knowledge_base.editor role, with clone_to_form permitted for any knowledge_base.* scope. The policy did not consult the underlying KnowledgeBase::AnswerPolicy for the specific answer being acted upon. As a result, a user with limited permissions on one knowledge base section could still invoke create, destroy, and clone_to_form actions against answers in other sections. The flaw maps to [CWE-639] Authorization Bypass Through User-Controlled Key, because the controller trusted the user-supplied answer identifier without verifying per-record authorization.

Root Cause

The AttachmentsController loaded the target answer through a before_action :fetch_answer filter and assigned it to the @answer instance variable without delegating authorization to the per-record AnswerPolicy. The controller policy only validated coarse role-level permissions rather than record-level access, leaving object-level authorization gaps on linked knowledge base items.

Attack Vector

An authenticated attacker with limited knowledge base read permissions sends HTTP requests to the attachments controller endpoints referencing an answer identifier that belongs to a restricted knowledge base category. Because the policy returned true based on the user's general editor role rather than the specific answer's permissions, the request was processed. No user interaction and no elevated privileges are required beyond a valid low-privilege Zammad account.

ruby

# Patched policy from app/policies/controllers/knowledge_base/answer/attachments_controller_policy.rb
class Controllers::KnowledgeBase::Answer::AttachmentsControllerPolicy < Controllers::ApplicationControllerPolicy
  def create?
    answer_policy.update?
  end

  def destroy?
    answer_policy.update?
  end

  def clone_to_form?
    answer_policy.show?
  end

  private

  def answer_policy
    @answer_policy ||= KnowledgeBase::AnswerPolicy.new(user, record.send(:answer))
  end
end

Source: Zammad GitHub Commit 13ccc13. The patch replaces the blanket default_permit!('knowledge_base.editor') directive with per-action checks that delegate to KnowledgeBase::AnswerPolicy, enforcing object-level authorization on each attachment operation.

Detection Methods for CVE-2026-56724

Indicators of Compromise

Requests to /api/v1/knowledge_bases/*/answers/*/attachments from accounts that do not have editor rights on the referenced answer's category
Successful POST or DELETE responses on knowledge base attachment endpoints followed by access to answers in previously unauthorized categories
Unexpected growth in attachment counts on restricted knowledge base answers after user activity from low-privileged accounts

Detection Strategies

Correlate Zammad application logs with user role assignments to identify attachment actions targeting answers outside the user's authorized knowledge base sections
Review audit history for KnowledgeBase::Answer::Attachment create and destroy events performed by non-editor accounts prior to upgrading to 7.0.2
Query the Zammad database for attachment modifications where the acting user lacks KnowledgeBase::AnswerPolicy#update? authorization on the parent answer

Monitoring Recommendations

Enable verbose request logging on the Zammad Rails application and forward logs to a centralized SIEM for retention and analysis
Alert on HTTP 2xx responses to knowledge_base/answer/*/attachments endpoints from users whose role does not include knowledge_base.editor
Track changes to knowledge base answers and attachments through Zammad's built-in history module and review entries attributed to low-privileged users

How to Mitigate CVE-2026-56724

Immediate Actions Required

Upgrade all Zammad instances to version 7.0.2 or later without delay
Audit user accounts with any knowledge_base.* permission and remove unnecessary editor assignments
Review knowledge base answer attachments created or deleted by low-privileged accounts since the vulnerable version was deployed

Patch Information

The fix is included in Zammad Release 7.0.2. The patch modifies app/controllers/knowledge_base/answer/attachments_controller.rb and introduces per-action authorization checks in app/policies/controllers/knowledge_base/answer/attachments_controller_policy.rb that delegate to the per-record KnowledgeBase::AnswerPolicy. Additional context is available in the GitHub Security Advisory GHSA-pv3q-74g5-w7fv.

Workarounds

No official workaround is published; upgrading to 7.0.2 is the only supported remediation
As a temporary compensating control, restrict knowledge base editor permissions to a minimal set of trusted administrators until the upgrade is complete
Place the Zammad web interface behind network access controls that limit reachability to trusted users while remediation is scheduled

bash

# Upgrade example for Docker-based Zammad deployments
docker compose pull
docker compose up -d
docker compose exec zammad-railsserver rails r 'puts Zammad::Version.get'
# Expected output: 7.0.2 or later