CVE-2026-56733 Zammad: Incorrect Authorization and Improper Privilege Management
An attacker can bypass token restrictions to create administrator accounts, gaining full control over the Zammad helpdesk system and all its data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56733?
CVE-2026-56733 is a high-severity vulnerability in zammad, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0.
Which versions are affected by CVE-2026-56733?
How do I fix CVE-2026-56733?
No fix has been published for CVE-2026-56733 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56733 being exploited?
There is no known exploitation of CVE-2026-56733 in the wild and no public exploit code.
Sources
Also known as GHSA-p3mg-2jxr-hww2.