New blog post: I found two authorization bypasses in Zammad's new AI text tools feature, two weeks after 7.0 shipped. Any agent could execute group-restricted tools and pull ticket data from other groups via a single API call.

Patched in 7.0.1, three CVEs from this audit.

https://moltenbit.net/posts/bypassing-zammad-ai-text-tool-authorization-via-rest-api/

#infosec #zammad #cybersecurity #responsibleDisclosure #security