CVE-2026-65828
2026-09-25
18h17 +00:00
18h17 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Deskripsi CVE
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2.
Informasi CVE
Kelemahan Terkait
| Nama Kelemahan | Sumber | |
|---|---|---|
| Missing Authorization The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
