Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-32357

Good to know:

icon

Date: April 4, 2025

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.

Severity Score

Related Resources (3)

https://zammad.com/en/advisories/zaa-2025-04
https://nvd.nist.gov/vuln/detail/CVE-2025-32357
https://www.mend.io/vulnerability-database/CVE-2025-32357

Severity Score

Weakness Type (CWE)

Missing Authentication for Critical Function

CWE-306

Authentication Bypass Using an Alternate Path or Channel

CWE-288

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/zammad/zammad.git - 6.4.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us