PT-2026-31420 · Zammad · Zammad

CVE-2026-34723 · Published 2026-04-08 · Updated 2026-04-09

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 and prior to 6.5.4

Description Zammad, a web-based open-source helpdesk system, allowed unauthenticated remote attackers to access sensitive internal entity data through the getting started endpoint, even after initial system setup. This access was possible in versions before 7.0.1 and 6.5.4.

Recommendations Update to version 7.0.1 or later. Update to version 6.5.4 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-34723

GHSA-HCM9-CH62-5727

Affected Products

Zammad

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34723.json · Exploit
• https://github.com/zammad/zammad/security/advisories/GHSA-hcm9-ch62-5727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34723 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34723 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2042054862360199488 · Twitter Post
• https://twitter.com/CVEnew/status/2041975599103619484 · Twitter Post