Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-34721

created 6 days, 16 hours ago

Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 and 6.5.4.

References

https://github.com/zammad/zammad/security/advisories/GHSA-mfwp-hx66-626c x_refsource_CONFIRM

Affected products

zammad

==< 6.5.4
==>= 7.0.0-alpha, < 7.0.1

Matching in nixpkgs

pkgs.zammad

Zammad, a web-based, open source user support/ticketing solution

nixos-unstable 7.0.0
- nixpkgs-unstable 7.0.0
- nixos-unstable-small 7.0.0
nixos-25.11 6.5.2
- nixos-25.11-small 7.0.0
- nixpkgs-25.11-darwin 7.0.0

pkgs.python312Packages.zammad-py

Python API client for accessing zammad REST API

nixos-25.11 3.2.0
- nixos-25.11-small 3.2.0
- nixpkgs-25.11-darwin 3.2.0

pkgs.python313Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1
nixos-25.11 3.2.0
- nixos-25.11-small 3.2.0
- nixpkgs-25.11-darwin 3.2.0

pkgs.python314Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1

Package maintainers

@Radvendii Taeer Bar-Yam <taeer@necsi.edu>
@NetaliDev Jennifer Graul <me@netali.de>
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>