CVE-2026-65828 zammad CVE debrief

Who should care

Defenders responsible for Zammad instances, particularly those using versions prior to 7.1.2, should assess exposure and apply the patch to prevent potential unauthorized file deletions.

Why it matters

CVE-2026-65828 is a vulnerability in Zammad that allows an authenticated attacker to delete temporary file uploads of another user. Defenders should prioritize verifying exposure and applying the patch for Zammad versions prior to 7.1.2 to prevent potential unauthorized file deletions and disruption of ticket or article submission process.

• Potential for unauthorized deletion of temporary file uploads
• Possible disruption of ticket or article submission process
• Need for verification of Zammad version and exposure
• Priority for applying patch to prevent exploitation

Technical summary

The legacy destroy_form action on AttachmentsController in Zammad versions prior to 7.1.2 allows an authenticated attacker to delete UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. This can lead to silent removal of temporary file uploads before the victim submits their ticket or article. The vulnerability is fixed in version 7.1.2, and defenders should prioritize verifying exposure and applying the patch for Zammad versions prior to 7.1.2 to prevent potential unauthorized file deletions and disruption of ticket or article submission process.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch for Zammad versions prior to 7.1.2.

Recommended defensive actions

• Verify if Zammad instance is vulnerable (version check)
• Apply patch to update Zammad to version 7.1.2 or later
• Monitor for suspicious activity related to file uploads and deletions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix in Zammad version 7.1.2. The legacy destroy_form action on AttachmentsController in Zammad versions prior to 7.1.2 allows an authenticated attacker to delete UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. This can lead to silent removal of temporary file uploads before the victim submits their ticket or article. Evidence is limited to public CVE and NVD records, and defenders

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.