CVE-2020-29159 in Zammad
Summary
by MITRE • 12/28/2020
An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This behvaior was unintended.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in Zammad version 3.5.1 and earlier represents a critical privilege escalation issue that stems from improper default configuration handling within the user management system. This flaw allows administrators to inadvertently configure the default signup role for new users as a privileged role, creating an unauthorized access vector that could potentially be exploited by malicious actors. The vulnerability is classified under CWE-276 as improper file or directory permissions, though it manifests more specifically as an insecure default configuration that violates the principle of least privilege.
The technical implementation of this vulnerability occurs within the Zammad application's user registration and role assignment mechanisms where the system fails to properly validate or restrict the assignment of privileged roles during the default signup process. When administrators configure the system to assign specific roles to new users upon registration, they can inadvertently select roles that possess elevated privileges such as administrative access, ticket management capabilities, or system configuration permissions. This misconfiguration bypasses the intended security boundaries and creates a persistent backdoor for unauthorized privilege escalation.
The operational impact of this vulnerability extends beyond simple user account creation and represents a fundamental breach in the application's access control model. An attacker who can influence the signup process or gain administrative access to configure system settings could potentially create accounts with elevated privileges, effectively compromising the entire system. This vulnerability particularly affects organizations that rely on automated user registration processes or allow self-service signups, as it provides an automated path for privilege escalation without requiring additional attack vectors. The issue directly violates security best practices outlined in the NIST Special Publication 800-53 and aligns with ATT&CK technique T1078 which covers valid accounts and credential access.
Organizations implementing this software should immediately audit their current configurations to ensure that default signup roles are restricted to basic user permissions only, typically limited to read-only access or standard operational capabilities. The recommended mitigation strategy involves updating to Zammad version 3.5.1 or later where the vulnerability has been patched, implementing strict configuration management procedures for role assignments, and conducting regular security audits of user permission settings. Additionally, organizations should establish clear policies governing who can modify system-level configurations and implement automated monitoring solutions to detect unauthorized changes to default role assignments, ensuring compliance with the principle of least privilege and maintaining robust access controls throughout their deployment environment.