Zammad Incorrect Access Control Vulnerability in Two-Factor Authentication Management

A vulnerability exists in Zammad versions 6.4.x prior to 6.4.2, where client-side enforcement of server-side security is inadequate. Users are required to re-authenticate with their current password when changing two-factor authentication settings. However, this requirement is only enforced on the front end and not through the API, allowing potential bypass of the authentication check.

Impact

Exploitation of this vulnerability could lead to incorrect access control, allowing users to change two-factor authentication settings without proper re-authentication when using the API.

Remediation

Users are advised to upgrade to Zammad versions 6.5.0 or 6.4.2. Fixed releases are available on the Zammad website or through the Zammad OS package manager.