CVE-2023-29867: Zammad

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.

Affected products

• Zammad Zammad: from 5.3.0, before 5.4.0 (fixed in 5.4.0)

Published 2023-05-02. Last modified 2026-06-17.