CVE-2026-61855 in Zammad
Summary
by MITRE • 09/25/2026
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid ("Good") PGP signature from a registered sender key, even though the displayed message content is not actually covered by that signature. As a result, the inbound article may be stored with a successful signature status that does not reflect the authenticity of the shown content. This can mislead agents who rely on the signature indicator when assessing the trustworthiness of incoming mail. This issue is fixed in version 7.1.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
Zammad, an open-source web-based helpdesk and customer support platform, contains a critical integrity verification flaw within its PGP email processing module affecting versions up to 7.1.1. The vulnerability arises from an insufficient validation mechanism when handling inbound emails signed with Pretty Good Privacy encryption standards. Specifically, the system fails to ensure that the cryptographic signature cryptographically binds to the exact message content displayed or stored by the application. This discrepancy allows a scenario where Zammad marks a message as having a valid "Good" PGP signature attributed to a registered sender key, even though the actual body of the email has been altered or does not match the signed data. Consequently, the inbound article is persisted in the database with a successful signature status that falsely indicates authenticity and integrity, creating a severe divergence between the cryptographic proof provided by the sender and the content actually presented to support agents.
The operational impact of this vulnerability is significant for organizations relying on Zammad for secure communication channels where non-repudiation and data integrity are paramount. Support agents who depend on visual indicators or system flags denoting verified PGP signatures may be misled into trusting email content that has potentially been tampered with during transit or by a malicious intermediary. This undermines the core security guarantee of PGP, which is to provide confidentiality, authentication, and integrity. In high-stakes customer support environments, such as those handling financial data, healthcare information, or legal matters, accepting unverified or altered messages under the guise of verified signatures can lead to incorrect decision-making, compliance violations, and potential exposure to social engineering attacks that exploit this trust in cryptographic verification.
From a technical classification perspective, this flaw aligns with CWE-345 Insufficient Verification of Data Authenticity, as the application fails to properly verify that the received data matches what was originally signed by the sender. It also relates closely to CWE-829 Inclusion of Functionality from Untrusted Control Sphere if one considers how external input is processed without adequate integrity checks before being marked as trusted. Furthermore, this vulnerability can be mapped to MITRE ATT&CK technique T1071 Application Layer Protocol, specifically within the context of email protocols like SMTP or IMAP where attackers might manipulate message bodies while preserving valid headers and signatures to bypass security controls that rely on signature validation for trust decisions.
The issue has been addressed in Zammad version 7.1.2 through enhanced verification logic that ensures strict binding between the signed data and the displayed content. Organizations running affected versions must upgrade immediately to mitigate this risk. In addition to patching, administrators should review recent inbound articles marked as PGP-signed for any anomalies or inconsistencies in message body text compared to expected sender patterns. Implementing additional monitoring for email integrity failures and ensuring that agents are trained to recognize potential discrepancies between signature status indicators and actual content can provide a defense-in-depth strategy while the infrastructure is updated.