CVE-2026-56729CWE-200CWE-280CWE-284broken-access-controlinformation-disclosure

CVE-2026-56729

published September 25, 2026

CVSS
2.1
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.

The record
Technical detail
CVSS
2.1 · NONE
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00377 · 30.5th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-280 · Improper Handling of Insufficient Permissions or Privileges; CWE-284 · Improper Access Control
Published
2026-09-25T21:17Z
References (4)
https://github.com/zammad/zammad/commit/5076aa1e3081146f826ffaef686c89935fdb4393 · [email protected]https://github.com/zammad/zammad/commit/7b6c0adec006e036c9e605c4141a091a6e08aadf · [email protected]https://github.com/zammad/zammad/commit/de5dc4195829e0e1a64307d60c9e06e0e781ab37 · [email protected]https://github.com/zammad/zammad/security/advisories/GHSA-4m54-p3mr-22g2 · [email protected]
EPSS history
Timeline
  • 27 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 25 SEP 16:58Z
    Zammad: Titles of knowledge base answers will be shown across all categories via the global search
    cvelistv5