CVE-2026-56727 zammad CVE debrief

Who should care

Users and agents relying on Zammad's signature indicator to confirm message authenticity and integrity should assess their exposure and verify their Zammad deployment. Additionally, security teams, operators, and platform administrators may be impacted by this vulnerability and should review their systems for potential exposure.

Why it matters

CVE-2026-56727 is a high-severity vulnerability in Zammad's PGP email processing that allows senders to tamper with email content and display it as cryptographically verified. Defenders should prioritize verifying Zammad's PGP integration configuration, reviewing email processing rules, and ensuring the latest version (7.0.2 or later) is deployed.

• Defenders must verify Zammad's PGP integration configuration to prevent email tampering.
• Users and agents may be misled into trusting modified or forged content due to incorrect signature verification.
• The vulnerability allows senders to craft messages with fabricated or mismatched signatures.
• Remediation priority is high for Zammad deployments that process inbound PGP-signed emails.

Technical summary

The vulnerability occurs because the return value of the gpg verification call is silently discarded in Zammad's inbound PGP email processing. This allows senders to tamper with the body of a multipart/signed PGP email or craft a message with an entirely fabricated or mismatched signature, which Zammad would display to the recipient as cryptographically verified with a 'Good signature' label. The issue affects users and agents relying on Zammad's signature indicator for message authenticity and integrity. To prevent email tampering and signature spoofing, defenders should prioritize verifying Zammad's PGP integration configuration, reviewing email processing rules, and ensuring the latest version (7.0.2 orlater

Defensive priority

Defenders should prioritize verifying Zammad's PGP integration configuration, reviewing email processing rules, and ensuring the latest version (7.0.2 or later) is deployed to prevent email tampering and signature spoofing.

Recommended defensive actions

• Verify Zammad's PGP integration configuration
• Review email processing rules
• Ensure Zammad version 7.0.2 or later is deployed
• Monitor for suspicious email activity
• Perform vulnerability scanning
• Review system logs for potential exploitation
• Implement additional security controls

Evidence notes

The vulnerability is confirmed in Zammad versions prior to 7.0.2. The fix is available in version 7.0.2. Users should verify their Zammad deployment and update to the latest version. To confirm exposure, defenders should review email processing rules, verify Zammad's PGP integration configuration, and monitor for suspicious email activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.