CVE-2026-34722— Zammad 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-34722の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Zammad is missing authorization in ticket create endpoint
ソース: CVE Program / CVE List V5
脆弱性説明
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
授权机制缺失
ソース: CVE Program / CVE List V5
脆弱性タイトル
Zammad 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Zammad是德国Zammad公司的一套票务管理软件。 Zammad 7.0.1之前版本和6.5.4之前版本存在安全漏洞，该漏洞源于票据创建端点缺少授权检查，可能导致安全风险。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
II. CVE-2026-34722の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-34722のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · zammad · 2026-04-08 · 10 CVEs total
| CVE-2026-34724 | Zammad has a server-side template injection leading to RCE via AI Agent | |
| CVE-2026-34837 | Zammad is miissing authorization in AI assistance controller for context data used in text | |
| CVE-2026-34248 | Zammad has an information disclosure in ticket detail view of customers in shared organiza | |
| CVE-2026-34720 | Zammad has an origin validation error in SSO mechanism | |
| CVE-2026-34721 | Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints | |
| CVE-2026-34719 | Zammad has a Server-side request forgery (SSRF) via webhooks | |
| CVE-2026-34718 | Zammad improperly neutralizes of script-related HTML tags in ticket articles | |
| CVE-2026-34782 | Zammad has improper access control in AI assistance controller for text tools | |
| CVE-2026-34723 | Zammad has incorrect access control in getting_started_controller |
IV. 関連脆弱性
同じ製品: zammad
- CVE-2026-13229
Zammad 7.0.1 - Improper authorization in ticket article atta - CVE-2026-34837
Zammad is miissing authorization in AI assistance controller - CVE-2026-34782
Zammad has improper access control in AI assistance controll - CVE-2026-34724
Zammad has a server-side template injection leading to RCE v - CVE-2026-34723
Zammad has incorrect access control in getting_started_contr
同じベンダー: zammad
- CVE-2026-13229
Zammad 7.0.1 - Improper authorization in ticket article atta - CVE-2026-34837
Zammad is miissing authorization in AI assistance controller - CVE-2026-34782
Zammad has improper access control in AI assistance controll - CVE-2026-34724
Zammad has a server-side template injection leading to RCE v - CVE-2026-34723
Zammad has incorrect access control in getting_started_contr
同じ弱点: CWE-862
- CVE-2026-70619
Odysseus Missing Admin Authorization via Embedding Endpoint - CVE-2026-70494
Open WebUI: A folder write-collaborator can permanently dele - CVE-2026-13227
ERPNext v16.25.0 - Improper authorization in Prospect opport - CVE-2026-70487
Open WebUI: Cross-user file content disclosure via request-s - CVE-2026-70484
Open WebUI: Users denied the image-generation permission can
V. CVE-2026-34722へのコメント
まだコメントはありません