CVE-2025-32359
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 5, 2025
Updated: Apr 15, 2025
CWE ID 602
Summary
CVE-2025-32359 is a vulnerability affecting Zammad version 6.4.x before 6.4.2. While users are required to re-authenticate with their password when changing two-factor authentication settings through the frontend, this security measure does not extend to API usage. This client-side enforcement of server-side security creates an unintended exposure, potentially allowing unauthorized access to Zammad accounts via API calls.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Zammad