PT-2026-31417 · Zammad · Zammad

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-34720

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 and prior to 6.5.4

Description Zammad, a web-based open-source helpdesk system, had an issue in its SSO mechanism. The system did not verify that the header originated from a trusted SSO proxy or gateway before proceeding with further actions. This could potentially allow an attacker to bypass authentication.

Recommendations Update to version 7.0.1 or 6.5.4

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-34720

Affected Products

Zammad

References · 3

• https://github.com/zammad/zammad/security/advisories/GHSA-hcv6-w4h9-p2p7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34720 · Security Note
• https://twitter.com/CVEnew/status/2041975603289624923 · Twitter Post