PT-2025-15073 · Zammad · Zammad

Published 2025-04-05 · Updated 2025-04-15 · CVE-2025-32360

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions 6.4.0 through 6.4.1

Description The issue concerns information exposure where logged-in customers can see details about shared article drafts for their customer tickets in the browser console, potentially containing confidential information. Additionally, customers can manipulate these drafts via API. This exposure is unintended, as only agents should have access to such information.

Recommendations For Zammad versions 6.4.0 through 6.4.1, update to version 6.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoints related to shared article drafts to prevent manipulation by unauthorized users.

Fix

Weakness Enumeration

CWE-402

Related Identifiers

CVE-2025-32360

Affected Products

Zammad

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-32360 · Security Note
• https://zammad.com/en/advisories/zaa-2025-03 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32360 · Vendor Advisory
• https://t.me/cvedetector/22199 · Telegram Post
• https://twitter.com/CVEnew/status/1908663651218972960 · Twitter Post
• https://twitter.com/dailycve/status/1912188610775810436 · Twitter Post
• https://t.me/cvetracker/20901 · Telegram Post