CVE-2025-32357

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-288 CWE-306

Affected software

Vendor	Product	Versions
Zammad	Zammad	>= 6.4, < 6.4.2

References

https://zammad.com/en/advisories/zaa-2025-04Vendor Advisory

Timeline

Published: Apr 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-323584.1In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests CVE-2025-323598.8In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication config CVE-2025-32365.3A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the fi CVE-2025-323608.1In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a CVE-2025-323639.8mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data.CVE-2025-323645.5A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed CVE-2025-323657.1Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc beca CVE-2025-323664.8In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and CVE-2025-323678.6The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Referen CVE-2025-323695.4Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with CVE-2025-32375.3A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the fi CVE-2025-323709.8Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becaus