CVE-2021-35301: Zammad

Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view.

Affected products

• Zammad Zammad: from 1.0.0, up to and including 4.0.0

Published 2021-06-28. Last modified 2026-06-17.