CVE-2026-56729

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/zammad/zammad/commit/5076aa1e3081146f826ffaef686c89935fdb4393
https://github.com/zammad/zammad/commit/7b6c0adec006e036c9e605c4141a091a6e08aadf
https://github.com/zammad/zammad/commit/de5dc4195829e0e1a64307d60c9e06e0e781ab37
https://github.com/zammad/zammad/security/advisories/GHSA-4m54-p3mr-22g2

Configurations

No configuration.

History

25 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-25 17:17

Updated : 2026-09-28 14:45

NVD link : CVE-2026-56729

Mitre link : CVE-2026-56729

CVE.ORG link : CVE-2026-56729

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-280

Improper Handling of Insufficient Permissions or Privileges

CWE-284

Improper Access Control

{"id": "CVE-2026-56729", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56729", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T17:08:08.905916Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "zammad", "product": "zammad", "versions": [{"status": "affected", "version": "< 7.0.2"}]}]}], "published": "2026-09-25T17:17:09.557", "references": [{"url": "https://github.com/zammad/zammad/commit/5076aa1e3081146f826ffaef686c89935fdb4393", "source": "security-advisories@github.com"}, {"url": "https://github.com/zammad/zammad/commit/7b6c0adec006e036c9e605c4141a091a6e08aadf", "source": "security-advisories@github.com"}, {"url": "https://github.com/zammad/zammad/commit/de5dc4195829e0e1a64307d60c9e06e0e781ab37", "source": "security-advisories@github.com"}, {"url": "https://github.com/zammad/zammad/security/advisories/GHSA-4m54-p3mr-22g2", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-280"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns \"Page not found,\" but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2."}], "lastModified": "2026-09-28T14:45:39.697", "sourceIdentifier": "security-advisories@github.com"}