Vulnerability Description
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zammad | Zammad | >= 6.4.0, < 6.4.2 |
Related Weaknesses (CWE)
References
- https://zammad.com/en/advisories/zaa-2025-02Vendor Advisory
FAQ
What is CVE-2025-32359?
CVE-2025-32359 is a vulnerability with a CVSS score of 4.8 (MEDIUM). In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current pa...
How severe is CVE-2025-32359?
CVE-2025-32359 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-32359?
Check the references section above for vendor advisories and patch information. Affected products include: Zammad Zammad.