CVE-2022-35487

—

CVSS 3.1

7.5 high

EPSS

<1%p53

Published

Aug 8, 2022 (Aug 8, 2022)

Modified

Jun 17, 2026

Description

Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files.

Vendors: zammad
Products: zammad
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.