CVE-2025-32360

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.

• CWE-402

• https://zammad.com/en/advisories/zaa-2025-03Vendor Advisory

Published

Apr 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32354In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site…8.8
• CVE-2025-32355Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse …7.9
• CVE-2025-32357In Zammad 6.4.x before 6.4.2, an authenticated agent with kn…4.3
• CVE-2025-32358In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated …4.1
• CVE-2025-32359In Zammad 6.4.x before 6.4.2, there is client-side enforceme…8.8
• CVE-2025-3236A vulnerability was found in Tenda FH1202 1.2.0.14(408). It …6.9
• CVE-2025-32363mediDOK before 2.5.18.43 allows remote attackers to achieve …9.8
• CVE-2025-32364A floating-point exception in the PSStack::roll function of …5.5
• CVE-2025-32365Poppler before 25.04.0 allows crafted input files to trigger…7.1
• CVE-2025-32366In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy…4.8
• CVE-2025-32367The Oz Forensics face recognition application before 4.0.8 l…8.6
• CVE-2025-32369Kentico Xperience before 13.0.181 allows authenticated users…5.4