CVE-2025-32360
Published: 05 April 2025
Summary
CVE-2025-32360 is a medium-severity Resource Leak (CWE-402) vulnerability in Zammad Zammad. Its CVSS base score is 4.2 (Medium).
Operationally, ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14713
Vulnerability details
In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in…
more
the browser console, which may contain confidential information, and also to manipulate them via API.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.