Vulnerability Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider may cause the server to connect to internal network locations. Response timing and error patterns differ between reachable and unreachable targets, allowing internal service probing. Worker processes may be blocked for several seconds per request. Requires a configured external authentication provider where the actor can modify their profile image URL. This issue is fixed in version 7.0.2.
Related Weaknesses (CWE)
References
- https://github.com/zammad/zammad/commit/1fae97d92496a643ea1490fb17070881e4e091d5
- https://github.com/zammad/zammad/releases/tag/7.0.2
- https://github.com/zammad/zammad/security/advisories/GHSA-q3cr-3wq3-29hx
FAQ
What is CVE-2026-56734?
CVE-2026-56734 is a documented vulnerability. Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetche...
How severe is CVE-2026-56734?
CVSS scoring is not yet available for CVE-2026-56734. Check NVD for updates.
Is there a patch for CVE-2026-56734?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.