CVE-2026-34248

MediumCVSS 5.7/10Last modified Jul 24, 2026

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-34258.8The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via t CVE-2026-342538.2A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in r CVE-2026-342567.1Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a pa CVE-2026-342576.1Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, CVE-2026-342584.7SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. S CVE-2026-342598.2Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorization CVE-2026-34264.3The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on CVE-2026-342609.6SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject maliciou CVE-2026-342616.5Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized cal CVE-2026-342624.3Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer CVE-2026-342639.6Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resul CVE-2026-342646.5During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authentic