CVE-2026-56733: Zammad Privilege Escalation Vulnerability

CVE-2026-56733 Overview

CVE-2026-56733 is a privilege escalation vulnerability in Zammad, an open source web-based helpdesk and customer support platform. The flaw resides in the authorization cascade used when initializing new identity objects. Under specific conditions, the granular restrictions assigned to an API access token are overridden by the broader authorization context of the parent account. This allows an authenticated attacker holding a restricted token to create new administrator accounts, bypassing the intended scope limitations of the token. The issue is tracked under [CWE-269: Improper Privilege Management] and is fixed in Zammad versions 7.0.2 and 7.1.0.

Critical Impact
An attacker with a restricted API token can create new administrator accounts, gaining full control over tickets, customers, configuration, and the entire Zammad instance.

Affected Products

Zammad versions prior to 7.0.2
Zammad versions prior to 7.1.0
Self-hosted and containerized Zammad helpdesk deployments

Discovery Timeline

2026-09-25 - CVE-2026-56733 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-56733

Vulnerability Analysis

The vulnerability stems from a missing authorization boundary between token-scoped requests and the parent user account that owns the token. Zammad supports API tokens with granular permission scopes, allowing administrators to issue keys limited to specific functional areas. During the initialization of new identity objects, the system failed to carry the token's restricted permission context forward into the authorization check. Instead, the request inherited the full authorization authority of the parent account.

An attacker with a low-privileged token can exploit this gap to iteratively escalate privileges. The attack culminates in creating a new user with administrator role assignments, despite the originating token lacking any such permission. Once the new administrator account is active, the attacker gains unrestricted access to tickets, customer records, system configuration, and integration secrets.

Root Cause

The root cause is a discrepancy in how UserContext propagates token metadata through controller actions and GraphQL channels. The pre-patch logic set @_current_user without binding the active token, allowing downstream policy checks to evaluate permissions against the user record rather than the token scope.

Attack Vector

Exploitation requires network access to the Zammad API and a valid, low-privileged API token. The attacker issues crafted requests to the user management endpoints to create a new identity with administrator role attributes. Because token scope is not enforced during object initialization, the request succeeds.

ruby

# Patch excerpt: app/controllers/application_controller/has_user.rb
# Binds token context explicitly to the current user session
def current_user_set(user, auth_type = 'session')
  session[:user_id] = user.id

  @_auth_type      = auth_type
  @_current_user   = user
  @_user_on_behalf = nil

  set_user
end

Source: Zammad Commit e50ef69

ruby

# Patch excerpt: app/channels/graphql_channel.rb
# Channels use session auth only; token is explicitly set to nil
context = {
  sid:             sid,
  current_user:    current_user && UserContext.new(current_user, nil),
  current_user_id: current_user&.id,
  channel:         self,

Source: Zammad Commit f059eb2d

Detection Methods for CVE-2026-56733

Indicators of Compromise

Creation of new user accounts with the Admin role from requests authenticated by API tokens with limited scope.
Unexpected entries in the Zammad audit log showing User.create actions originating from token-based sessions.
API requests to /api/v1/users from client IPs that previously only interacted with restricted endpoints.
Role assignment changes shortly after a new user is provisioned via token authentication.

Detection Strategies

Correlate token authentication events with privileged administrative actions, flagging mismatches between token scope and executed operation.
Enable Zammad's history and audit logging modules to capture user creation events with the authenticating token identifier.
Baseline normal API token behavior and alert on deviations such as access to user management endpoints.

Monitoring Recommendations

Forward Zammad application and web server logs to a centralized SIEM for query against user-creation and role-change events.
Review all active API tokens and audit the accounts and roles they have provisioned since deployment.
Monitor outbound notifications for newly created administrator accounts, including welcome emails and password reset flows.

How to Mitigate CVE-2026-56733

Immediate Actions Required

Upgrade Zammad to version 7.0.2 or 7.1.0 as released by the vendor.
Audit all existing user accounts and remove any administrator accounts that cannot be attributed to a legitimate provisioning event.
Rotate all API tokens, giving priority to tokens with any level of user management scope.
Review GitHub Security Advisory GHSA-p3mg-2jxr-hww2 for vendor guidance.

Patch Information

The vendor released fixes in Zammad 7.0.2 and Zammad 7.1.0. The patches rework the UserContext initialization and enforce authorization checks before protected operations execute. See commits e50ef69 and f059eb2d for the complete fix.

Workarounds

Restrict network access to the Zammad API to trusted management networks until the patch is applied.
Revoke all non-essential API tokens and limit token issuance to session-authenticated administrators only.
Place the Zammad instance behind a reverse proxy that blocks unauthenticated or anomalous requests to /api/v1/users endpoints.

bash

# Upgrade example for Docker-based Zammad deployments
docker pull zammad/zammad:7.1.0
docker compose down
docker compose up -d

# Verify running version
curl -s https://zammad.example.com/api/v1/version