CVE-2026-34837

MediumCVSS 4.3/10Last modified Jul 24, 2026

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-348389.9Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulner CVE-2026-348396.5Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/CVE-2026-34848.8A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the CVE-2026-348408.1OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/Featur CVE-2026-348419.8Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromise CVE-2026-348476.1hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulner CVE-2026-348485.4hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member ov CVE-2026-348494.7UAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-34859.8A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the CVE-2026-348505.9Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-348517.5Race condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availability CVE-2026-348526.5Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability.