CVE-2022-27331: Zammad

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.

Affected products

• Zammad Zammad: before 5.1.0 (fixed in 5.1.0)

Published 2022-04-27. Last modified 2026-06-17.