Zammad versions 6.3.0 to 6.5.3 are affected by a session hijack vulnerability that allows an attacker to execute code remotely with the privileges of the zammad user. Although the vulnerability exists in versions 7.0.0 to 7.1.3, exploitation is prevented by environment conditions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, high impact on confidentiality, integrity, and availability, and a critical exploitability rating.

Successful exploitation allows remote code execution as the zammad user, which can lead to full compromise of the affected system under the privileges of that user. This poses a high risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply patches once available.