CVE-2025-32360 - CVE House
Back to Database
Status published Medium CVE-2025-32360

In Zammad 6.4.x before 6.4.2, there is information exposure. Only...

Vulnerability Description

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32360

Credits & Attribution

No credits recorded in the NVD database.

References

More from Zammad

View All →
CVE-2025-32359
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of...
Medium 4.8
CVE-2025-32358
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin...
Medium 4
CVE-2025-32357
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge...
Medium 4.3

Affected Vendor

Affected Software

Zammad
Vulnerable Versions:
6.4

Timeline

Official Publish: April 5th, 2025
Last Modified: April 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-402

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.