Zammad Information Exposure Vulnerability Allowing Customers to Access and Manipulate Shared Drafts

An information exposure vulnerability exists in Zammad versions 6.4.x prior to 6.4.2. This issue allows logged-in customers to view details of shared article drafts related to their customer tickets through the browser console. These drafts, which are meant to be accessible only to agents, may contain confidential information. Additionally, customers could manipulate these drafts via the API.

Impact

Exploitation of this vulnerability could lead to unauthorized access to confidential information contained in shared article drafts, as well as the ability to manipulate these drafts through the API.

Remediation

Users are advised to upgrade to Zammad version 6.5.0 or 6.4.2. Fixed releases are available on the Zammad website, Zammad FTP, or through the OS package manager.