CVE-2022-27331

4.3 mediumEPSS 0.7%

Medium (4.3) in zammad zammad. EPSS 0.7% chance of exploitation in the next 30 days.

An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-668
Published: 2022-04-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zammad:zammad

References

https://zammad.com/de/advisories/zaa-2022-02
https://zammad.com/de/advisories/zaa-2022-02

Check your stack JSON