CVE-2020-26033: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Zammad before version 3.4.1, where the Tag and Link REST API endpoints (specifically for add and delete operations) lacked a CSRF token check. The vulnerability was disclosed on September 22, 2020, and was assigned CVE-2020-26033. This security flaw affected Zammad versions 1.0.x up to 3.4.0 (Zammad Advisory).

The vulnerability stemmed from the implementation of Tag and Link REST API endpoints that were processing requests via GET method instead of POST. Due to the use of GET requests, no CSRF token checks were performed on these endpoints, creating a security weakness in the application (Zammad Advisory).

The vulnerability could allow an attacker to add or delete Tags and Links from a user that the web application trusts, potentially compromising the integrity of the system's data. The severity of this vulnerability was classified as low by the vendor (Zammad Advisory).

An attacker could exploit this vulnerability by crafting requests to manipulate Tags and Links through the affected REST API endpoints, taking advantage of the missing CSRF token validation (Zammad Advisory).

The vulnerability was fixed in Zammad version 3.4.1 and 3.5.0. Users are recommended to upgrade to these or later versions. The fix can be obtained through the official Zammad website, FTP server, or through the OS package manager (Zammad Advisory).

The vulnerability was discovered and reported by Michał Błaszczak, a security researcher associated with Zdalny Admln (Zammad Advisory).