An unauthenticated remote attacker can cause a denial of service on Zammad installations by exhausting the Puma worker pool through a specifically crafted API request.

The vulnerability stems from missing authentication guards on the import_check and import_status actions within the Zammad API. An unauthenticated attacker can trigger a resource intensive retry loop that blocks request workers for approximately two minutes per request, leading to complete service exhaustion.

This vulnerability carries a CVSS score of 8.7, which indicates a high-severity risk to business operations. Because the flaw allows for trivial, unauthenticated denial of service, it poses a direct threat to the availability of the helpdesk system, potentially halting customer support workflows and damaging organizational productivity.

Immediate Action: Update all Zammad instances to version 7.0.2 or later to apply the necessary authentication guards and prevent the resource-intensive loop.

Proactive Monitoring: Review web server access logs for repeated POST requests to /api/v1/import/otrs/import_check originating from unauthorized sources.

Compensating Controls: Implement rate limiting or block access to the /api/v1/import/otrs/ endpoint at the Web Application Firewall (WAF) layer until the patch can be applied.

Public Exploit Available: No

The high severity of this vulnerability, combined with the ease of exploitation, necessitates immediate attention. Administrators should prioritize upgrading to version 7.0.2 to close the authentication gap and restore system resilience against denial of service attacks.