CVE-2022-40817

—

CVSS 3.1

4.3 medium

EPSS

<1%p37

Published

Sep 27, 2022 (Sep 27, 2022)

Modified

Jun 17, 2026

Description

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.

Vendors: zammad
Products: zammad
Weakness: CWE-732
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.