CVE-2025-32359: Zammad

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.

Affected products

• Zammad Zammad: from 6.4.0, before 6.4.2 (fixed in 6.4.2)

Published 2025-04-05. Last modified 2026-06-17.