CyberRota Analysis
AI-GeneratedZammad versions prior to 7.0.2 are vulnerable to an information disclosure issue where users with editor access to specific knowledge base categories can view answer titles and updated timestamps from other categories they do not have access to through the global quick search. While category names are not exposed, the leaked titles may inadvertently reveal sensitive information. Organizations using Zammad should prioritize upgrading to version 7.0.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.