CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 4.8. See the original NVD description below for full technical details.
CVE
CVE-2025-32359
Severity
MEDIUM
CVSS
4.8
EPSS
0.27%
Original NVD Description
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.
Related CVEs
Other vulnerabilities affecting the same vendor(s)