Vulnerability Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is already stored in the system. An attacker can create their own certificate using the name of a real, previously trusted sender and use it to send a forged email. Zammad will display that email with the same "validly signed" indicator as a genuine message from the real sender, even though the attacker never had access to that sender's actual certificate or private key. This issue is fixed in version 7.1.2.
Related Weaknesses (CWE)
References
- https://github.com/zammad/zammad/commit/9a07d0b8214ac4e8e10c23fce71d613bd0625524
- https://github.com/zammad/zammad/security/advisories/GHSA-m9ff-hjr3-93h4
FAQ
What is CVE-2026-84465?
CVE-2026-84465 is a documented vulnerability. Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing cer...
How severe is CVE-2026-84465?
CVSS scoring is not yet available for CVE-2026-84465. Check NVD for updates.
Is there a patch for CVE-2026-84465?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.