CVE-2026-34723: 
NixOS vulnerability analysis and mitigation

CVE-2026-34723 is an improper access control vulnerability in Zammad, a web-based open source helpdesk/customer support system. Unauthenticated remote attackers can access the getting_started_controller endpoint to retrieve sensitive internal entity data, even after the system setup has been completed. The vulnerability affects all Zammad versions prior to 6.5.4 and version 7.0.0, and is fixed in versions 6.5.4 and 7.0.1. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat).

The root cause is CWE-284 (Improper Access Control) in Zammad's getting_started_controller, which fails to enforce authentication checks on the "getting started" setup endpoint after system initialization is complete (GitHub Advisory). An attacker can send unauthenticated HTTP requests directly to this endpoint over the network, with no special preconditions, privileges, or user interaction required. The endpoint, intended only for initial system configuration, continues to expose sensitive internal entity data to any remote caller regardless of the system's operational state. The vulnerability was credited to researcher 0xrajdip, who documented the discovery via two simple curl requests to the affected endpoints (Medium).

Successful exploitation results in high confidentiality impact, allowing unauthenticated attackers to retrieve sensitive internal entity data from Zammad installations without any authentication. There is no integrity or availability impact — the vulnerability is purely an information disclosure issue. Exposed data may include internal system configuration details or entity records that could facilitate further targeted attacks against the Zammad instance or its users (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.00136, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it trivially exploitable by any remote attacker who can reach the Zammad web interface.

1. Reconnaissance: Identify internet-facing Zammad instances using search engines (e.g., Shodan, Censys) or by browsing to the target's web interface to confirm the Zammad version is prior to 6.5.4 or is exactly 7.0.0.
2. Identify the vulnerable endpoint: Locate the getting_started_controller endpoint, which is accessible at the Zammad base URL (e.g., /getting_started or a related API path).
3. Send unauthenticated request: Issue a simple HTTP GET or POST request to the getting started endpoint without any authentication headers or session tokens, for example: curl -s https://<target>/getting_started.
4. Retrieve sensitive data: Parse the response, which will contain sensitive internal entity data (e.g., system configuration, internal records) that should only be accessible to authenticated administrators (GitHub Advisory, Medium).

• Network: Unexpected or repeated unauthenticated HTTP requests to the /getting_started (or related setup controller) endpoint from external or unknown IP addresses.
• Logs: Web server or application access logs showing requests to the getting started endpoint from unauthenticated sessions after system setup has been completed; look for 200 OK responses to these requests from non-administrative source IPs.
• Logs: Anomalous access patterns such as high-frequency requests to the setup endpoint from a single IP, or requests originating from geographic regions inconsistent with normal user base.

Zammad has released patched versions 6.5.4 (for the 6.x branch) and 7.0.1 (for the 7.x branch); upgrading to one of these versions is the recommended remediation (GitHub Advisory). For organizations unable to patch immediately, applying network-level controls (e.g., firewall rules, reverse proxy access restrictions) to limit access to the Zammad service to trusted IP ranges can reduce exposure. Additionally, monitoring access logs for unauthenticated requests to the getting started endpoint is advised as a detective control.

The vulnerability was discovered and reported by researcher 0xrajdip, who published a write-up on Medium describing how two simple curl requests to the endpoint were sufficient to trigger the issue and earn a CVE (Medium). The advisory was published by Zammad's security team on GitHub and tracked by Red Hat's CVE database. No significant broader media coverage or notable community controversy has been observed beyond standard CVE tracking and aggregation sites.