CVE-2026-34722

CVE-2026-34722 is an authorization bypass vulnerability in Zammad, an open-source web-based helpdesk and customer support platform, affecting versions prior to 7.0.1 and 6.5.4. The vulnerability exists in the ticket creation endpoint when the link-adding parameter is utilized, allowing unauthorized actions to be performed. This flaw has been remediated in the patched versions 7.0.1 and 6.5.4. The vulnerability carries a CVSS 3.1 severity score of 4.3 (MEDIUM) with a network-based attack vector requiring low complexity and low privileges. The impact is limited to integrity compromise with no confidentiality or availability impact. The EPSS score of 0.00033 indicates this vulnerability has minimal probability of exploitation compared to the broader CVE landscape, ranking lower than approximately 95.9% of all published CVEs. There is no evidence of active exploitation in the wild, as indicated by the absence of this CVE from the Known Exploited Vulnerabilities (KEV) catalog and inactive status on threat intelligence hot lists. Organizations running affected Zammad versions should prioritize patching to versions 7.0.1 or 6.5.4 to remediate this authorization bypass, though the low exploitation probability suggests this is not an imminent threat.