影響を受けるバージョン系列
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-102345 | Zammad: Stored XSS in ticket article rendering in the new Vue-based interface | * | 5.1 | — | 2026-11-05 | |
| CVE-2026-63208 | Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens | * | 5.1 | — | 2026-09-26 | |
| CVE-2026-63006 | Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-63204 | Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets | * | 2.3 | — | 2026-09-26 | |
| CVE-2026-61855 | Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-84461 | Zammad: Missing rate limiting allows password brute-forcing during two-factor login | * | 6.9 | — | 2026-09-26 | |
| CVE-2026-63207 | Zammad: Sensitive Information Exposure in Integration Administration API | * | 6.9 | — | 2026-09-26 | |
| CVE-2026-84465 | Zammad: S/MIME signature verification allows forged sender impersonation | * | 7.1 | — | 2026-09-26 | |
| CVE-2026-84463 | Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped if... | * | 6.3 | — | 2026-09-26 | |
| CVE-2026-84464 | Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data | * | 7.1 | — | 2026-09-26 | |
| CVE-2026-63216 | Zammad: Stored XSS via unescaped option labels in the object attribute options context UI | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-84458 | Zammad: Account takeover via unverified email matching during SSO auto-link | * | 9.1 | — | 2026-09-26 | |
| CVE-2026-84460 | Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-63206 | Zammad: Remote image tracking bypass via shortened URL scheme | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-63205 | Zammad: Channel admins can read unauthorized attachments via signature rich-text body | * | 5.1 | — | 2026-09-26 | |
| CVE-2026-84462 | Zammad: AI Agent template sanitizer bypass leads to remote code execution | * | 8.6 | — | 2026-09-26 | |
| CVE-2026-65828 | Zammad: Pending upload deletion bypass via legacy attachment endpoint | * | 2.3 | — | 2026-09-26 | |
| CVE-2026-61525 | Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller | * | 8.8 | — | 2026-09-26 | |
| CVE-2026-56728 | Zammad: Cross-User Taskbar Item Access Control Vulnerability | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-56725 | Zammad: Denial of Service via OTRS Import Controller | * | 8.7 | — | 2026-09-26 | |
| CVE-2026-56732 | Zammad: Malicious input in Ticket Body Enables Session Termination | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-56730 | Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers | * | 2.1 | — | 2026-09-26 | |
| CVE-2026-56733 | Zammad: Incorrect Authorization and Improper Privilege Management | * | 8.7 | — | 2026-09-26 | |
| CVE-2026-56731 | Zammad: Cross-Site Scripting in Ticket Notifications | * | 8.4 | — | 2026-09-26 | |
| CVE-2026-56735 | Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-56727 | Zammad: PGP signature spoofing via unvalidated verification return | * | 7.1 | — | 2026-09-26 | |
| CVE-2026-56734 | Zammad: Avatar Image URL Server-Side Request Forwarding | * | 5.3 | — | 2026-09-26 | |
| CVE-2026-56726 | Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak | * | 5.1 | — | 2026-09-26 | |
| CVE-2026-56729 | Zammad: Titles of knowledge base answers will be shown across all categories via the global search | * | 2.1 | — | 2026-09-26 | |
| CVE-2026-56723 | Zammad: Missing authorization on ticket attachment download | * | 7.1 | — | 2026-09-26 | |
| CVE-2026-56724 | Zammad: Incorrect implementation of permission checks in the knowledge base module | * | 7.1 | — | 2026-09-26 | |
| CVE-2026-13229 | Zammad 7.0.1 - Improper authorization in ticket article attachment cloning | ≤ 7.0.1 | 7.1 | — | 2026-08-05 | |
| CVE-2026-34837 | Zammad is miissing authorization in AI assistance controller for context data used in text tools | * | 5.3 | — | 2026-04-09 | |
| CVE-2026-34782 | Zammad has improper access control in AI assistance controller for text tools | * | 5.3 | — | 2026-04-09 | |
| CVE-2026-34724 | Zammad has a server-side template injection leading to RCE via AI Agent | * | 8.7 | — | 2026-04-09 | |
| CVE-2026-34723 | Zammad has incorrect access control in getting_started_controller | * | 8.7 | — | 2026-04-09 | |
| CVE-2026-34722 | Zammad is missing authorization in ticket create endpoint | * | 6.9 | — | 2026-04-09 | |
| CVE-2026-34721 | Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints | * | 5.9 | — | 2026-04-09 | |
| CVE-2026-34720 | Zammad has an origin validation error in SSO mechanism | * | 2.3 | — | 2026-04-09 | |
| CVE-2026-34719 | Zammad has a Server-side request forgery (SSRF) via webhooks | * | 8.3 | — | 2026-04-09 | |
| CVE-2026-34718 | Zammad improperly neutralizes of script-related HTML tags in ticket articles | * | 5.3 | — | 2026-04-09 | |
| CVE-2026-34248 | Zammad has an information disclosure in ticket detail view of customers in shared organizations | * | 2.1 | — | 2026-04-09 | |
| CVE-2025-32358 | In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which a... | ≥ 6.4 < 6.4.2 | 4.0 | — | 2025-04-05 | |
| CVE-2025-32357 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zamma... | ≥ 6.4 < 6.4.2 | 4.3 | — | 2025-04-05 | |
| CVE-2025-32360 | In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on sha... | ≥ 6.4 < 6.4.2 | 4.2 | — | 2025-04-05 | |
| CVE-2025-32359 | In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their tw... | ≥ 6.4 < 6.4.2 | 4.8 | — | 2025-04-05 | |
| CVE-2020-29158 | An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass inten... | * | — | — | 2020-12-28 | |
| CVE-2020-29159 | An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a pri... | * | — | — | 2020-12-28 | |
| CVE-2020-29160 | An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article da... | * | — | — | 2020-12-28 | |
| CVE-2020-14214 | Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authoriza... | * | — | — | 2020-06-17 | |
| CVE-2020-14213 | In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read int... | * | — | — | 2020-06-17 | |
| CVE-2018-1000154 | Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in... | * | — | — | 2018-04-05 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。