CVE-2026-34837

OVERVIEW CVE-2026-34837 is an authorization bypass vulnerability in Zammad, an open source web-based helpdesk and customer support system. The flaw exists in the REST API endpoint POST /api/v1/ai_assistance/text_tools/:id in versions prior to 7.0.1. The vulnerability allows authenticated users to supply context data (such as group or organization information) to AI prompts without proper authorization validation, potentially exposing data that the user should not have access to. SEVERITY This is a medium-severity vulnerability with a CVSS score of 4.3. The attack requires network access and low privileges (ticket.agent permission), but no user interaction is needed. The impact is limited to confidentiality breach, as the vulnerability only results in unauthorized data disclosure without affecting system integrity or availability. An attacker could access sensitive organizational or group information through the AI assistance feature that they are not authorized to view. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is reported to be available. The EPSS score of 0.0003 indicates very low probability of exploitation in the wild, suggesting limited community attention and low threat actor interest at this time. The patch is available in version 7.0.1, and affected organizations should prioritize updating to remediate this authorization flaw.