CVE-2020-14214: 
NixOS vulnerability analysis and mitigation

Zammad before version 3.3.1, when Domain Based Assignment is enabled, contains a vulnerability where the system relies on a claimed e-mail address for authorization decisions. The vulnerability (CVE-2020-14214) was disclosed on June 15, 2020, affecting Zammad versions 1.0.x up to 3.3.0 (Zammad Advisory).

The vulnerability exists in the authentication mechanism where the system fails to properly verify email addresses before granting organization access. When both the 'shared Organization' feature (enabled by default) and the 'domain based assignment' feature (disabled by default) are active, the system makes authorization decisions based on unverified email addresses (Zammad Advisory).

If exploited, an attacker can register a new account with a non-existing email address containing the domain of an existing Organization. This allows unauthorized access to all tickets of the targeted Organization without requiring email address verification (Zammad Advisory).

The vulnerability has been fixed in Zammad versions 3.3.1 and 3.4.0. Users are recommended to upgrade to these or later versions. Updates are available through the official website, FTP server, or OS package manager (Zammad Advisory).