Security readout for executives and security teams
Plain-English summary
Zammad 5.2.1 did not fully enforce read-only ticket access. An authenticated agent who should only view tickets could still change some ticket metadata, including links, tags, and related answers. The business impact is limited integrity risk, not data theft or outage, and the issue is reported fixed in Zammad 5.2.2.
Executive priority
Treat this as a moderate-priority maintenance and access-control issue. It is not described as remotely exploitable without credentials, but it can undermine ticket integrity where read-only access is part of operational control, audit separation, or customer support governance.
Technical view
CVE-2022-40817 is a CWE-732 permission enforcement flaw in Zammad 5.2.1. CVSS 3.1 is 4.3 with network access, low attack complexity, required low privileges, no user interaction, and low integrity impact only. The documented unauthorized operations are adding or removing ticket links, tags, and related answers.
Likely exposure
Exposure is most likely where Zammad 5.2.1 is deployed and read-only ticket permissions are used for agents. The source bundle does not identify affected CPEs, hosting models, or earlier versions, so scope beyond 5.2.1 should be confirmed from vendor guidance.
Exploitation context
The provided sources do not state active exploitation, and this CVE is not marked KEV. Abuse requires an authenticated agent-level context, not anonymous access. Impact is constrained to unauthorized ticket metadata or relationship changes documented by the advisory.
Researcher notes
The source evidence is narrow but consistent: the flaw concerns incomplete enforcement of fine-grained ticket permissions. Focus validation on authorization boundaries around ticket link, tag, and related-answer operations. Do not assume broader ticket edit capability or data disclosure without additional vendor evidence.
Mitigation direction
- Upgrade affected Zammad 5.2.1 systems to version 5.2.2 or later.
- Review the Zammad advisory before making production changes.
- Audit roles that rely on read-only ticket permissions.
- Review recent ticket link, tag, and related-answer changes by read-only agents.
- Restrict agent accounts that do not require ticket access.
Validation and detection
- Inventory Zammad instances and confirm whether version 5.2.1 is present.
- Check whether read-only ticket permissions are configured for agents.
- Confirm fixed behavior on 5.2.2 or later in a controlled test environment.
- Review logs or audit history for unauthorized ticket metadata changes.
- Document any affected workflows that depended on read-only ticket integrity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-732: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-40817 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://zammad.com/de/advisories/zaa-2022-10CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.