CVE-2026-34723

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-34723

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34723.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-34723

Aliases

GHSA-hcm9-ch62-5727

Published

2026-04-08T18:14:08.582Z

Modified

2026-07-15T02:19:26.917024240Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Zammad has incorrect access control in getting_started_controller

Details

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was completed. This vulnerability is fixed in 7.0.1 and 6.5.4.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34723.json"
}

References

Affected packages

Git / github.com/zammad/zammad

Affected ranges

Type

GIT

Repo

https://github.com/zammad/zammad

Events

Introduced

Fixed

15c7e6d4ffd95c84535d334b7c0ce0bc2fbc5228

Introduced

f3228274c4feefac470d7efad12f240debd678bc

Last affected

f3228274c4feefac470d7efad12f240debd678bc

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zammad:zammad:7.0.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.5.4"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.0"
        }
    ]
}

Affected versions

1.*

1.6.0

3.*

3.7.0

5.*

5.2.0-alpha

5.3.0-alpha

5.4.0-alpha

5.5.0-alpha

6.*

6.0.0-alpha

6.1.0-alpha

6.2.0-alpha

6.3.0-alpha

6.4.0-alpha

6.5.0

6.5.0-alpha

6.5.1

6.5.2

6.5.3

7.*

7.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34723.json"