Zammad Release Notes

Recommended Resolution

SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• Unfiltered sign-up and ticket update fields allow cross-organization ticket disclosure and takeover
• Multi-factor authentication could be bypassed through the email verification flow
• Remote code execution via template sanitizer bypass in automation configuration
• Stored XSS in desktop autocomplete fields via unescaped option label
• Stored XSS in ticket zoom via attacker-controlled article preferences
• Arbitrary configuration disclosure via recent view endpoint …

Want to see the new features in action? Join our release webinar or let Marcel—aka “That Helpdesk Guy”—walk you through the highlights in his latest video on YouTube.

Join the Release Webinar Watch YT Video

1. Security & Compliance

🛡️ Tamper-Proof Admin Audit Log

Who changed which setting, and when? Especially in larger Zammad environments, having a clear answer to this question isn't just helpful for troubleshooting—it's vital for IT security, internal controls, and external audits.

With version 7.2, we are introducing an audit log for administrative actions. Changes made in the admin area are recorded in a tamper-proof way and can be fully traced. As with the ticket history, these entries cannot be edited or deleted — either through the user interface or via the API.

The audit log is much more than just a record of administrative changes. It provides a reliable basis for demonstrating accountability and control processes to auditors. Along with Zammad's ISO/IEC 27001:2022 certification and SOC 2 Type I, it establishes an even stronger foundation for security and compliance. …

Recommended Resolution

SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• SSRF protection bypass via DNS rebinding in hostname safety check
• Arbitrary object disclosure via Core Workflow perform endpoint
• Cross-tenant attachment disclosure via inline images in notification emails
• Disclosure of external data source credentials to non-admin users via object attribute metadata
• Disclosure of group-restricted text modules to unauthorized agents
• Improper access control allows agents to read and modify other users' overview ordering preferences …

Recommended Resolution

SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• AI Agent template sanitizer bypass leads to remote code execution
• S/MIME signature verification allows forged sender impersonation
• Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
• IDOR in External Data Source rendering exposes ticket, user, group, and organization data
• Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
• Missing article authorization in ticket attachment clone endpoint …