An improper privilege management vulnerability in Zammad allows authenticated attackers to escalate privileges to administrator status, resulting in a complete takeover of the helpdesk instance.

This is an improper privilege management and incorrect authorization vulnerability where the system fails to correctly validate access restrictions during the creation of new identity objects. An authenticated attacker can exploit this discrepancy to override token limitations and elevate their permissions to administrative level.

The ability to create unauthorized administrator accounts represents a critical integrity breach of the entire trust environment. Successful exploitation grants an attacker full access to sensitive customer data, support tickets, and system configurations, which could lead to significant data exfiltration, regulatory non-compliance, and total loss of system confidentiality and availability. With a CVSS score of 8.7, this vulnerability poses a high risk to organizational security.

Immediate Action: Update Zammad to version 7.0.2 or 7.1.0 immediately to apply the necessary authorization cascade fixes.

Proactive Monitoring: Review system audit logs for the creation of new administrator accounts or suspicious modifications to user identity objects.

Compensating Controls: Implement strict network access controls to limit access to the Zammad administrative interface to authorized personnel only, reducing the attack surface for potentially compromised accounts.

Public Exploit Available: No (exploit_available: false)

Given the severity of this privilege escalation flaw, administrators must prioritize patching the Zammad instance to the recommended versions. Failure to remediate could allow an attacker to bypass existing security controls and gain persistent, high-level access to the helpdesk environment. Immediate deployment of the provided vendor update is the only effective way to mitigate this risk.