Multiple vulnerability on Zammad Helpdesk - MFA Bypass via Email Verification Flow & Template Sanitizer Bypass to RCE in Automation Config & Cross-Organization Ticket Disclosure & Takeover via Unfiltered Fields & Arbitrary Configuration Disclosure via Recent View Endpoint & Second-order SQL Injection in Ticket Overview Sorting
The impacted technology is Zammad, an open-source, web-based customer support and ticketing system used for managing client communications and helpdesk operations. GHSA-f3qr-94c2-7mx2 Zammad's email verification flow contains an authentication flaw that bypasses configured multi-factor authentication (MFA). If an account has never completed its initial email verification, possessing the registration verification link allows a user to establish a fully authenticated session without needing a password or fulfilling the second factor. This grants the full privileges of that target account, potentially up to an administrator role. GHSA-gvvq-mfj3-g56x A high-severity remote code execution (RCE) vulnerability exists via a template sanitizer bypass inside the system's automation configurations, such as ticket triggers, macros, scheduled jobs, or AI agents. Users permitted to alter these settings—or systems processing data returned by malicious AI providers—can inject crafted payloads that bypass text-escaping protocols. This results in arbitrary command execution on the host server under the privileges of the Zammad application process. GHSA-79wh-8g2f-xj2c This critical vulnerability features unfiltered fields within both the public sign-up form and the ticket update mechanisms, allowing cross-organization ticket disclosure and takeover. Attackers can self-register using unowned email addresses, mark them as pre-verified, and forcibly join any target organization to read or reply to private tickets. Additionally, flaws in the ticket-updating path permit standard customer roles to shift ownership of existing tickets away from their original creators. GHSA-g9f6-7w7h-99f7 An authorization bypass endpoint allows arbitrary configuration disclosure to any authenticated entity, including low-privilege customer roles. Roughly a quarter of Zammad's default application parameters are left unprotected or unmapped to specific roles, allowing unauthorized users to read deployment secrets. This data can reveal critical operational credentials, such as Elasticsearch passwords or backend import source secrets. GHSA-h5pm-rjvp-fr47 Zammad's ticket overview handling is vulnerable to a second-order SQL injection flaw embedded within its sort-order configurations. Users authorized to configure or modify ticket overviews can submit unescaped keywords that append malicious syntax directly into database queries executed through the API. If exploited, this allows actors to exfiltrate database contents like password hashes and internal tickets, or potentially run code on the database host if the database server process holds elevated privileges.
