Zammad Information Disclosure Vulnerability in Shared Organizations

A vulnerability allowing information disclosure has been identified in Zammad versions prior to 7.0.1. Customers in shared organizations could access fields not intended for them, such as ticket priority and custom internal attributes, when viewing tickets from other users within the same organization. This issue has been resolved in Zammad 7.0.1.

Impact

Exploitation of this vulnerability allowed customers in shared organizations to view unintended fields in ticket details, including priority and custom attributes meant for internal use only.

Remediation

Users can upgrade to Zammad version 7.0.1 to address this vulnerability.