CVE-2026-56734 in Zammad
Summary
by MITRE • 09/25/2026
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider may cause the server to connect to internal network locations. Response timing and error patterns differ between reachable and unreachable targets, allowing internal service probing. Worker processes may be blocked for several seconds per request. Requires a configured external authentication provider where the actor can modify their profile image URL. This issue is fixed in version 7.0.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Zammad versions prior to 7.0.2 represents a critical server-side request forgery flaw inherent to its federated authentication mechanisms, specifically affecting OAuth, OIDC, and SAML integrations. As an open-source helpdesk system relying heavily on external identity providers for user management, Zammad processes metadata returned during the login flow, including profile images. The core technical failure lies in the application's handling of these image URLs; when a user authenticates via a connected provider, the server fetches the specified URL to retrieve and store the avatar without performing any validation against an allowlist or checking for internal network ranges. This lack of input verification allows an attacker who controls their profile on the external identity provider to inject arbitrary URLs pointing to internal services that are not intended to be accessible from the internet-facing Zammad instance.
The operational impact of this flaw extends beyond simple data exfiltration, as it facilitates active reconnaissance and service discovery within the organization's private network infrastructure. Because the server initiates HTTP requests on behalf of the user, an attacker can manipulate the profile image URL to target internal IP addresses or hostnames that are otherwise unreachable from external networks. The vulnerability is particularly potent due to its potential for blind exploitation; even if the response body is not directly returned to the client, differences in response timing and error patterns between reachable and unreachable targets allow the attacker to infer network topology. This side-channel information leakage enables precise internal service probing, effectively turning a standard authentication flow into a powerful tool for mapping internal assets and identifying vulnerable services that may be running on non-standard ports or behind firewalls designed to block external access but not outbound requests from application servers.
Furthermore, this vulnerability introduces significant availability risks through resource exhaustion attacks. Each request made by the Zammad worker process to fetch an image can take several seconds to complete, particularly if targeting unreachable hosts where timeouts must elapse before failure is reported. An attacker capable of triggering repeated authentication flows or manipulating multiple accounts could cause these blocking operations to accumulate, leading to a denial of service condition for legitimate users. The combination of network reconnaissance capabilities and potential resource exhaustion makes this issue severe, as it compromises both the confidentiality of internal network structures and the availability of the helpdesk system itself.
Mitigation strategies must prioritize immediate patching alongside architectural hardening. Organizations running Zammad prior to version 7.0.2 should upgrade to the patched release immediately to eliminate the root cause of the unvalidated URL fetching. For environments where upgrading is not instantly feasible, network-level controls such as egress filtering on the application server can restrict outbound connections to only known external domains and block access to private IP ranges like RFC1918 addresses. Additionally, implementing a proxy for image retrieval that validates URLs against a strict allowlist before making requests would provide defense in depth. From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) and maps to the ATT&CK technique T1046 Network Service Discovery, highlighting its role in enabling attackers to map internal network services through application-layer interactions rather than direct network scanning tools.