CVE-2024-49193: Zendesk · Authentication Bypass by Spoofing
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 52% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 12 Oct 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Organizations should immediately update Zendesk to the version released after 2024-07-02 that addresses this vulnerability. If patching is not immediately possible, implement the following mitigations: 1) Restrict and monitor inbound email sources to Zendesk, employing email authentication protocols such as SPF, DKIM, and DMARC to reduce the risk of spoofed emails reaching the system. 2) Configure Zendesk to limit or disable automatic authorization based on Cc fields or implement additional verification steps for email-based ticket access. 3) Use unpredictable, unique support email addresses per ticket or customer to reduce the predictability exploited by attackers. 4) Monitor ticket access logs for unusual or unauthorized access patterns. 5) Educate support staff about the risk of email spoofing and encourage vigilance when handling sensitive ticket information. 6) Employ network-level protections such as email gateways with advanced anti-spoofing and phishing detection capabilities. These combined measures will reduce the attack surface until a full patch is applied.
Description
Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and used to grant additional authorization for ticket viewing, the mechanism for detecting spoofed e-mail messages is insufficient, and the support e-mail addresses associated with individual tickets are predictable.