What’s Vulnerable › Vulnerabilities
CVE-2025-32360
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-05 · updated 2026-06-17
- Weakness: CWE-402
Description
In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.
Affected products
- zammad: from 6.4.0 before 6.4.2 — fixed in 6.4.2
How to fix
Upgrade to a fixed version: zammad 6.4.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-32360 or the next vulnerability affects your stack