Zammad Knowledge Base Incorrect Access Control Vulnerability

A vulnerability exists in Zammad versions 6.4.x prior to 6.4.2, allowing authenticated agents with knowledge base permissions to use the Zammad API to access knowledge base content for which they do not have authorization.

Impact

Exploitation of this vulnerability could lead to unauthorized access to knowledge base content.

Remediation

Users are advised to upgrade to Zammad version 6.5.0 or 6.4.2. The latest releases can be downloaded from the Zammad website or via the Zammad FTP site. Users with Zammad installed through an operating system package manager should update through that method.