CVE-2026-84460CWE-639

CVE-2026-84460

published September 25, 2026

CVSS
5.3
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-25T23:17Z
References (3)
https://github.com/zammad/zammad/commit/13217eb6b3fdf350228b13f8cf69f640b8fd0da2 · [email protected]https://github.com/zammad/zammad/commit/d1a5eabdd1285b202f75761c4406edc5509e217e · [email protected]https://github.com/zammad/zammad/security/advisories/GHSA-6vgm-xxp4-p6jv · [email protected]
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 18:14Z
    Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
    cvelistv5