CVE-2025-32359 - CVE House
Back to Database
Status published Medium CVE-2025-32359

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of...

Vulnerability Description

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32359

Credits & Attribution

No credits recorded in the NVD database.

References

More from Zammad

View All →
CVE-2025-32360
In Zammad 6.4.x before 6.4.2, there is information exposure. Only...
Medium 4.2
CVE-2025-32358
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin...
Medium 4
CVE-2025-32357
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge...
Medium 4.3

Affected Vendor

Affected Software

Zammad
Vulnerable Versions:
6.4

Timeline

Official Publish: April 5th, 2025
Last Modified: April 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-602

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.