CVE-2026-56729
2026-09-25
17h17 +00:00
17h17 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Exposure of Sensitive Information to an Unauthorized Actor The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
||
| Improper Handling of Insufficient Permissions or Privileges The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. |
||
| Improper Access Control The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
