---
id: CVE-2026-84458
title: Zammad is a web based open source helpdesk/customer support system
summary: >-
  Zammad is a web based open source helpdesk/customer support system. Prior to
  7.1.2, when the "Automatic account link on initial logon" setting is enabled,
  Zammad binds an incoming third-party (SSO) identity to an existing local
  account b…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-287
vendor: zammad
product: zammad
affected:
  - zammad < 7.1.2
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T19:17:57.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84458'
references:
  - url: >-
      https://github.com/zammad/zammad/commit/0dba387df8e2b46956907975034cd44e4d021b1c
    label: security-advisories@github.com
  - url: 'https://github.com/zammad/zammad/security/advisories/GHSA-86cc-3ggh-mf2m'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-25T19:04:52.695359Z'
cvssSource: cna
ingestedAt: '2026-09-25T19:15:38.964Z'
---

## Overview

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email address the identity provider reports, without verifying that the provider actually confirmed ownership of that email. An attacker who controls any identity at a configured provider, including, by default, any Azure AD tenant via Zammad's multi-tenant Microsoft 365 /common app registration, can set that identity's email to a victim's address, authenticate, and be logged in as the victim. This bypasses the victim's local password entirely and affects any existing account, including agents and administrators. Zammad will honor the xms_edov ID token claim when email verification is required in the Microsoft 365 setting, treating a missing claim as unverified. This issue is fixed in version 7.1.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.