CVE-2026-34722: 
NixOS vulnerability analysis and mitigation

CVE-2026-34722 is a missing authorization vulnerability in Zammad, a web-based open source helpdesk and customer support system. The ticket creation endpoint fails to enforce authorization checks when the link-adding parameter is supplied, allowing unauthorized link manipulation during ticket creation. Affected versions include all Zammad releases up to and including 7.0.0 and all versions prior to 6.5.4. The vulnerability was published on April 8, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization): the ticket creation API endpoint does not verify whether the requesting user has the necessary permissions to add links when the link parameter is included in the request. An authenticated (or potentially unauthenticated, per CVSS v4 metrics) remote attacker can craft a ticket creation request that includes the link parameter, bypassing the authorization layer and associating arbitrary links with tickets. No complex preconditions or special configurations are required beyond network access to the Zammad instance (GitHub Advisory).

Successful exploitation allows an attacker to create unauthorized ticket links within the Zammad helpdesk system, resulting in a low integrity impact to the vulnerable system. There is no direct confidentiality or availability impact, and the vulnerability does not affect subsequent systems. While the scope is limited, unauthorized link creation could be used to manipulate ticket workflows, associate unrelated tickets, or obscure audit trails within the support system (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-34722. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was credited to researcher YasinSeyhun (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible Zammad instance running a version ≤ 7.0.0 or < 6.5.4 using web search, Shodan, or direct browsing to the Zammad login page.
2. Access the ticket creation endpoint: Authenticate to the Zammad instance (if authentication is required) or directly target the ticket creation API endpoint.
3. Craft a malicious request: Submit a ticket creation API request that includes the link parameter (e.g., a reference to another ticket ID) that the user would not normally be authorized to link.
4. Bypass authorization: Because the endpoint does not validate permissions for the link parameter, the server processes the request and creates the unauthorized ticket link.
5. Achieve objective: The attacker has now associated arbitrary tickets via links without proper authorization, potentially manipulating ticket relationships or obscuring support workflows (GitHub Advisory).

• Logs: Zammad application logs showing ticket creation API requests (POST /api/v1/tickets) that include a link parameter from users or roles not authorized to create ticket links; unusual volume of ticket link creation events from a single user or IP address.
• Application Data: Unexpected ticket links appearing in the Zammad database between tickets that should not be related, particularly created by low-privilege accounts.
• Network: Repeated API calls to the ticket creation endpoint with link parameters from unexpected source IPs or user agents.

Zammad has released patched versions 7.0.1 and 6.5.4 that enforce proper authorization checks on the ticket creation endpoint when the link parameter is used. Administrators should upgrade to Zammad 7.0.1 (for the 7.x branch) or 6.5.4 (for the 6.x branch) as soon as possible. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation (GitHub Advisory).