https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T19:57:26.489368+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-65828 CVE-2026-65828 — Zammad: Pending upload deletion bypass via legacy attachment endpoint 2026-09-29T19:57:26.490331+00:00

Affected: zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2.