Insufficiently protected credentials in Zammad - #VU153214
Published: October 3, 2026
Vulnerability identifier: #VU153214
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose external data source credentials.
The vulnerability exists due to improper access control in object attribute metadata when retrieving object attribute configurations. A remote user can retrieve object attribute metadata to disclose external data source credentials.
Only instances configured with an external data source attribute containing access data are affected.
Affected software
Zammad
Remediation
Install security update from vendor's website.
Zammad - update to 7.1.3