Zammad Missing Authorization Vulnerability in AI Assistance Text Tools Endpoint

A vulnerability exists in Zammad versions prior to 7.0.1 and 6.5.4, where the REST endpoint POST /api/v1/ai_assistance/text_tools/:id lacked proper authorization checks. This oversight allowed users to access the text tool without the necessary privileges. The issue has been addressed in versions 7.0.1 and 6.5.4.

Impact

Exploitation of this vulnerability allowed users to access and use the AI text tools without proper authorization, potentially leading to unauthorized actions or access within the application.

Remediation

Users can upgrade to Zammad versions 7.0.1 or 6.5.4 to address this vulnerability.