An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have insufficient permissions).
View Full Alert
Related Posts
CVE-2020-26028 (zammad)An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. View Full Alert
CVE-2020-26029 (zammad)An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the…
CVE-2020-26030 (zammad)An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An attacker can create…
