CVE-2026-56729

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-56729

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56729.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-56729

Aliases

GHSA-4m54-p3mr-22g2

Published

2026-09-25T16:58:05Z

Modified

2026-09-27T03:47:36Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Zammad: Titles of knowledge base answers will be shown across all categories via the global search

Details

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-280",
        "CWE-284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56729.json"
}

References

Affected packages

Git / github.com/zammad/zammad

Affected ranges

Type

GIT

Repo

https://github.com/zammad/zammad

Events

Introduced

Fixed

5076aa1e3081146f826ffaef686c89935fdb4393

Fixed

7b6c0adec006e036c9e605c4141a091a6e08aadf

Fixed

de5dc4195829e0e1a64307d60c9e06e0e781ab37

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "7.0.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.6.0

3.*

3.7.0

5.*

5.2.0-alpha

5.3.0-alpha

5.4.0-alpha

5.5.0-alpha

6.*

6.0.0-alpha

6.1.0-alpha

6.2.0-alpha

6.3.0-alpha

6.4.0-alpha

6.5.0-alpha

6.6.0-alpha

7.*

7.0.0

7.0.0-alpha

7.0.1

7.1.0-alpha

7.2.0-alpha

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56729.json"