CVE-2026-34782
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id did not check if a user is privileged to use the text tool, allowing its use in all situations without proper authorization.
Risk Assessment
An unauthorized user can misuse the text tool to manipulate data or access functions they should not have, potentially compromising system integrity.
Recommendation
Upgrade Zammad to version 7.0.1 or 6.5.4, which contain the fix.
Original NVD description (English source)
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations. This vulnerability is fixed in 7.0.1 and 6.5.4.