Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Zammad lets attacker create admin accounts

CVE-2026-56733 · published 15 days ago
Summary

In Zammad versions before 7.0.2 and 7.1.0, the system can ignore the limits of an access token and let a new user be given full administrator rights. An attacker could exploit this to gain complete control over tickets, customer data, and settings. Upgrade to Zammad 7.0.2 or 7.1.0 (or later) to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
zammad zammad < 7.0.2
Original advisory text
Zammad: Incorrect Authorization and Improper Privilege Management
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
CWE-863Incorrect Authorization
Timeline
Published25 Sep 2026
Updated9 Oct 2026
First seen25 Sep 2026
Sources
CVE-2026-56733 · NVD
CVE-2026-56733 · MITRE
CVE-2026-56733 · OSV
GHSA-p3mg-2jxr-hww2 · GHSA
Track software like this
Free during beta