Security Release

Zammad 7.1.1 & 7.0.3

June 25, 2026 · We have released Zammad 7.1.1 and 7.0.3. These security updates address a critical vulnerability, and we highly recommend applying them to keep your helpdesk secure.
Read on for full details:

In this article

• Recommended Resolution
• 🚨 Important note on the update
• Infos & Advisories / Downloads

A vulnerability in the Sessions module has been successfully resolved. Due to a lack of input validation on the client_id parameter, an authenticated user could inject directory traversal sequences (../) to trigger a recursive deletion of arbitrary files and directories via FileUtils.rm_rf on the server. The deletion occurs as a side effect during session lookup (Sessions.get), before the controller returns any response and regardless of whether the lookup itself succeeds.

Recommended Resolution

SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

⚠️ Important Note: anyone still using version 7.0 needs to switch to the stable-7.0 branch to receive the latest update.

Vulnerabilities patched

• Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller: github.com/zammad/zammad/security/advisories/GHSA-xp9w-hhf3-vfxx

🚨 Important note on the update

Before updating, all self-hosted users with a package installation must migrate to the new package hosting by changing their repository configuration. The old repositories will only serve versions prior to 7.1.x and will be available for a short time before the service is shut down. For instructions on updating your package management, refer to the documentation.

Original source

Minor Release

Zammad 7.1

June 17, 2026 · This release helps you bring more structure to your support workflows while reducing manual effort. Turn incoming requests into clean, actionable data — with privacy at the core and control firmly in your hands.

In this article

• 🔍 Information extraction with regex
• 🎯 New AI Agent: Text Extractor
• 🏷️ New AI Agent: Ticket Tagger
• 🚨 Important note on the update
• 📣 Important Announcements
• Infos & Advisories / Downloads

From extracting specific values with regex to identifying information and adding tags with AI, Zammad 7.1 helps support teams capture the right information faster and keep ticket data structured from the start.

Want to see the features in action? Join our release webinar or let Marcel—aka “That Helpdesk Guy”—walk you through the highlights in his latest video on YouTube.

Join the Release Webinar
Watch Video from That Helpdesk Guy

🔍 Information extraction with regex

Sometimes, you really do need to find the needle in the haystack. External ticket numbers, order IDs, customer references, and other structured values are often hidden in the subject or message body of an email.

With Zammad 7.1, admins can now use regular expressions, or regex, in Postmaster filters to extract specific text from incoming emails and reuse it in filter actions. This makes it possible to automatically populate ticket attributes based on the content of an email.

Extracted values are made available in a structured namespace, such as regex.NAME, and can be used as placeholders in the action section of the Postmaster filter.

👉 Learn more in our admin documentation
regex in Postmaster filters

🎯 New AI Agent: Text Extractor

While regex is especially useful for clearly defined patterns, the new AI Agent for text extraction is designed to work with natural language. It can analyze incoming tickets and identify information such as contact names, product mentions, or invoice numbers — even when these details do not follow a consistent format.

The extracted information can be written into the corresponding ticket attributes automatically. This reduces manual data entry, improves data quality, and helps support teams work with structured, usable information from the moment a ticket arrives.

👉 Read all the details in our admin documentation
AI Text Extractor

🏷️ New AI Agent: Ticket Tagger

Well-placed tags make tickets easier to find, group, and analyze. They also provide an important basis for automation. In everyday support work, however, manual tagging can quickly fall behind — especially when ticket volume increases.

With Zammad 7.1, the new AI Agent for ticket tagging can automatically enrich incoming tickets with relevant tags. Whether there is a sudden increase in mentions of “app crashes” or a growing number of requests about “billing”, automatic tagging helps keep tickets structured, searchable, and ready for analysis, even as volume grows.

The result is cleaner ticket organization, better visibility into emerging trends, and more reliable workflows — even when things get busy.

👉 More in our admin documentation
AI Ticket Tagger

🚨 Important note on the update

Before updating, all self-hosted users with a package installation must migrate to the new package hosting by changing their repository configuration. The old repositories will only serve versions prior to 7.1 and will be available for a short time before the service is shut down. For instructions on updating your package management, refer to the documentation.
If you use the functionality for out-of-office replacements, we encourage to do a elasticsearch reindex.

📣 Important Announcements

Elasticsearch 7 support will end with Zammad 7.1

From Zammad 7.2 onward, Elasticsearch 7 will no longer be supported. Elasticsearch 8 or later will be required.

Calendar iCal feed must be a URL

Starting with Zammad 7.2, calendars can no longer be configured with a local file path as the iCal feed source. Only HTTP/HTTPS URLs are accepted.
⚠️ If you are currently using a local .ics file path, please host the file on an HTTP server and update the calendar's iCal feed URL before upgrading to Zammad 7.2.

Deprecated es-ca locale inactivated

The deprecated es-ca locale for Catalan will no longer be offered for selection starting with Zammad 7.2. Users still set to es-ca will be automatically migrated to the proper ca locale. Existing Knowledge Base locales referencing es-ca will not be migrated automatically due to the URL change and must be updated manually.

Stricter default Content-Security-Policy

Starting with Zammad 7.2, the default Content-Security-Policy header will include a new frame-ancestors 'self' directive.
⚠️ Setups that currently allow the Zammad web interface to be embedded in an on a different origin by overriding the X-Frame-Options header at the reverse proxy will now be blocked again by the new frame-ancestors 'self' CSP directive. To re-enable embedding from trusted origins, the frame-ancestors directive of the Content-Security-Policy response header must be adjusted at the reverse proxy as well.

Original source

Security Release

Zammad 7.0.1 & 6.5.4

April 8, 2026 · Our latest security updates address vulnerabilities in Zammad versions 7.0 and 6.5. For users who cannot yet upgrade to version 7.0, we have provided back-portable fixes for version 6.5.

Read on for full details:

In this article

• Recommended Resolution
• Zammad 7.0.1
• Zammad 6.5.4
• Infos & Advisories / Downloads

Recommended Resolution

SaaS Customers:

No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations:

We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Zammad 7.0.1

For full technical details, please refer to the security advisories on GitHub.

Vulnerabilities patched

• Information disclosure in ticket detail view of customers in shared organizations
• Incorrect access control in getting_started_controller
• Improper neutralization of script-related HTML tags in ticket articles
• Improper access control in AI assistance controller for text tools
• Server-Side Template Injection leading to RCE via AI Agent type_enrichment_data
• Missing authorization in AI assistance controller for context data used in text tools
• Server-side request forgery (SSRF) via webhooks
• Cross-site request forgery (CSRF) in OAuth callback endpoints
• Origin validation error in SSO mechanism
• Missing authorization in ticket create endpoint

Zammad 6.5.4

For full technical details, please refer to the security advisories on GitHub.

Vulnerabilities patched

• Incorrect access control in getting_started_controller
• Improper neutralization of script-related HTML tags in ticket articles
• Server-side request forgery (SSRF) via webhooks
• Cross-site request forgery (CSRF) in OAuth callback endpoints
• Origin validation error in SSO mechanism
• Missing authorization in ticket create endpoint

Original source

Zammad 6.5.3

Zammad 6.5.3 is a security release that provides all back-portable fixes for users of version 6.5 who cannot yet update to version 7.0.
Read on for all the details:

Insertion of Sensitive Information into Log File

A vulnerability was identified where Zammad recorded the REDIS_URL environment variable into log files during startup. This variable may contain credentials information.
📖 For more details, please refer to the Security Advisory ZAA-2026-02

Incorrect Access Control

Ticket customers were able to use the API to move their tickets to other groups they have no permissions for. This behavior has been corrected and is no longer possible.
📖 For more details, please refer to the Security Advisory ZAA-2026-03

Exposure of Sensitive Information to an Unauthorized Actor

Unauthorized users were able to use the API to get information about internal import status metadata. This is no longer possible.
📖 For more details, please refer to the Security Advisory ZAA-2026-04

Authorization Bypass Through User-Controlled Key

Authorized agent users were able to use the ticket_related endpoint to fetch asset data of arbitrary tickets, including customer and related user information. This is no longer the case.
📖 For more details, please refer to the Security Advisory ZAA-2026-05

SQL Injection

Due to improper SQL statement sanitization, authorized agent or customer users were able to use several API endpoints to inject custom statements to SQL queries. This could lead to the execution of unwanted operations on database level.
📖 For more details, please refer to the Security Advisory ZAA-2026-06

Original source

Long awaited, now finally here: With Zammad 7.0, the first AI features are making their way into your everyday support work. We have worked hard to develop a solution that requires no compromises: Benefit from intelligent support while retaining full control over your data and the language model used.

Zammad 7.0 makes AI a practical tool for your helpdesk — from automated ticket actions and lightning-fast summaries to hands-on support when drafting replies. And we’re staying true to our principle: we provide the features, you stay in control of the infrastructure. Which LLM is used is entirely up to you — aligned with your own security standards.

Want to see what that looks like in practice and how our beta testers rate the new features? Head over to our AI topic page.

But first — the release highlights 👇

🎥 Prefer watching to reading?
No problem! Marcel – aka That Helpdesk Guy – will guide you through what’s new in Zammad 7.0 in his latest YouTube video. Nerd talk included!

1. AI agents: Intelligent process control

Our AI agents do the groundwork in your inbox. Once configured, they can be flexibly integrated into triggers, macros, or scheduler jobs. These agents take on tasks such as automatic categorization, setting priorities, or even overwriting ticket titles for greater clarity.

• Complete transparency: Every action taken by an AI agent is documented in the ticket history, so every change remains traceable.
• Live collision notification: When an AI agent is processing a ticket, this is indicated by an avatar in the live user bar. This prevents simultaneous manual changes.

Setup and requirements:

1. AI provider: Before you activate agents, the LLM of your choice must be configured.
2. Permissions: The new permission ‘admin.ai_agent’ is required to manage agents.
3. Activation: Define your AI agents under “AI” > “AI Agents.” These do not run on their own, but must be explicitly called as an action in a trigger, macro, or scheduler job (e.g., perform action on objects: AI Agent > [your agent]).

You can find all the details on setting up the different types in our Zammad Admin documentation on AI Agents.

2. AI ticket summary: Your 'TL;DR' Section

Long ticket histories take time. With the AI summary, agents can get a precise overview of the conversation so far and the core issues of a case with just one click. This ensures immediate knowledge transfer, especially during handovers or escalations, without having to manually review pages of communication history.

What the AI summary provides you at a glance:

• Customer Intent: What does the customer want to achieve?
• Conversation Summary: What has been discussed so far?
• Open questions: What is still unclear, what information is missing?
• Upcoming Events: What appointments/tasks are pending (e.g., callback, shipping)?
• Customer Sentiment: What is the tone of the ticket (e.g., cooperative, neutral, angry)?

Setup and requirements:

• Not active by default: The feature is disabled by default. Before activation, an AI provider (LLM) must be configured. If no provider is stored, the system will display a warning message.
• Modular configuration: While the customer concern and summary are set by default after activation, you can flexibly enable or disable the other analysis modules (open questions, events, sentiment) as needed and depending on the use case.
• Resource control: As an admin, you can set whether the summary is generated automatically when the ticket is opened (maximum convenience) or only when the tab is clicked (resource-saving). This setting can be defined individually for each group.

You can find all the details on setup in our Zammad admin documentation on AI Summary.

3. AI writing assistant: Your digital editor

The AI writing assistant helps your team in the ticket editor to formulate more precise and professional responses. The AI provides suggestions, but the final decision always rests with your agents.

Standard tools (activate and use immediately):

• Convert drafts into well-written paragraphs
• Correct spelling and grammar
• Easily rephrase complex paragraphs
• Summarize long texts concisely
• Translate into other languages

Custom tools:

Create your own AI writing assistants for very specific use cases, for example, for industry-specific wording or to give texts a very specific tone (mood).

Detailed information on setup and configuration can be found in our Zammad admin documentation on AI writing assistants.

4. Bubble menu: Text formatting with a click of your cursor

Zammad 7.0 makes text editing much more convenient. Previously, formatting options were mainly accessible via keyboard shortcuts. Now, the new bubble menu provides all the important text formatting tools conveniently in the editor.

• Tools at your fingertips: Use formatting options such as bold, italics, or lists, as well as the new AI writing tools, directly on your selection.
• Auto-scroll: To help you stay focused, the menu always remains visible—even when the selection is at the edge of the screen.
• Smooth workflow: The menu eliminates the need for long mouse movements and makes keyboard shortcuts optional without interrupting your writing flow.

5. Smart details, big impact

In addition to major AI innovations, we have made many adjustments to make Zammad even more flexible and powerful.

LDAP extension: Support for nested groups

Zammad now supports nested (recursive) groups for role mapping. Admins can decide individually for each assignment whether users from subgroups should be automatically included. This enables seamless integration of existing, complex directory structures without additional manual effort.

Role-based reporting profiles

Access to reporting profiles can now be restricted to specific roles (similar to overviews). For example, team leaders can be given targeted access to relevant metrics without reporting remaining an “all-or-nothing” tool. Without an assigned role, a profile remains visible to all users with reporting permissions.

Advanced webhook functionality

Webhooks now support additional HTTP methods and the Bearer token authentication standard. This not only makes connecting third-party systems more secure, but also allows Zammad to communicate with itself via its own API. This enables complex processes to be automated, such as the automatic creation of follow-up tickets or the direct assignment of checklist templates when tickets are updated.

🚨 Important note on the update

The new ASCII folding support in the search requires that the Elasticsearch index (if used) be rebuilt after updating to Zammad 7.0. Detailed information can be found in our documentation at Rebuilding Elasticsearch Index.

⚠️ Breaking Changes

• MySQL support discontinued, database-related application settings obsolete
• Full-text search now supports Asciifolding
• nginx configuration must be updated
• Assigning the same organization as the primary and secondary organization is no longer permitted.
• Change to the Catalan language setting
• Removal of Slack integration (now via webhooks)
• Removal of Twitter/X integration

📣 Important Announcements

We are changing the behavior of the hidden setting system_bcc in the next release. System notifications will no longer be sent automatically with system_bcc. From now on, only customer communications will continue to be sent.

Original source

In this article

• Insertion of Sensitive Data into Log File
• Incorrect Access Control
• Insecure Storage of Sensitive Information
• Infos & Advisories / Downloads

Insertion of Sensitive Data into Log File

The admin interface of Zammad wrote sensitive details, such as private keys, certificates, and passphrases, to the Rails log file.

🏠 Self-hosted users: We strongly recommend updating immediately. Additionally, please review your existing logs — and any connected systems that process them — to identify and clean up potentially exposed data.

☁️ SaaS users: No action is required. We’ve already taken the necessary steps on our end.

📖 For more details, please refer to the Security Advisory ZAA-2025-07.

Incorrect Access Control

Logging subsystem (HttpLog) API access control is now more fine grained. In the past, any admin.* permission was sufficient to access this data. Now, only the relevant parts can be accessed (e.g. admin.webhook).

🏠 For self hosted installations, we strongly advise admins to update their system to Zammad 6.5.2.

☁️ For our SaaS customers, there’s nothing you need to worry about: we’ve already taken care of everything for you.

📖 For more details, please refer to the Security Advisory ZAA-2025-08.

Insecure Storage of Sensitive Information

Logging subsystem (HttpLog) would store complete requests in the database, including sensitive information like tokens, secrets, etc. This was prevented and existing HttpLog records were cleaned up.

🏠 Self-hosted installations: Please update your system to apply the fix and prevent further exposure.

☁️ SaaS users: You’re already protected — no further action needed.

📖 For more details, please refer to the Security Advisory ZAA-2025-09.

Original source

Security Release

Zammad 6.5.1

August 13, 2025 · Important security updates are included in this release. All self-hosted instances must be updated immediately.

Please read on for details:

In this article

• Incorrect Access Control in Knowledge Base
• HTML Injection
• Technical Requirements
• Advisories
• Download Zammad 6.5.1

Incorrect Access Control in Knowledge Base

A permission issue was identified where agents could see titles of Knowledge Base articles they didn’t have permission to access when using the global search. While the article content remained protected, these entries should not have been visible at all. This has now been corrected.

📖 For more details, please refer to the Security Advisory ZAA-2025-05.

HTML Injection

Various sections of the Zammad front end failed to perform the correct HTML escape function when outputting data. This could have allowed HTML injection in the browser. However, execution of JavaScript code was correctly prevented by Content Security Policy.

📖 For more details, please refer to the Security Advisory ZAA-2025-06.

🎥 Prefer video over text?

No problem! In his latest YouTube video, Marcel – aka That Helpdesk Guy – takes you on a quick, clear, and slightly nerdy tour of the latest security release.

👉 Watch the video

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisories

ZAA-2025-05

ZAA-2025-06

Download Zammad 6.5.1

All improvements can be found in the Changelog.

Packages

• Ubuntu / Debian
• OpenSUSE / SLES
• CentOS / RHEL
• Docker-Compose

Source code

• ftp.zammad.com/zammad-6.5.1.tar.bz2 (fe9b2e645f8ecb8bb1b090d8aa61a846)
• ftp.zammad.com/zammad-6.5.1.tar.gz (9e2789a9f54f06166332cf78d4011b64)
• ftp.zammad.com/zammad-6.5.1.zip (33da8a7755fff7e6787b88cf109d489a)

Upgrade

Here you can find information on upgrading your Zammad installation:

• With Package
• From source
• With Docker

Original source

Security Release

Zammad 6.4.2

April 2, 2025 · This release includes important security patches. Please read the release notes carefully and update your Zammad system as soon as possible.

In this article

• Server Side Request Forgery
• Incorrect Access Control
• Incorrect Access Control to Article Drafts
• Technical Requirements
• Advisories
• Download Zammad 6.4.2

Server Side Request Forgery

Authenticated administrators can configure webhooks that send POST requests when specific conditions are met. If a webhook endpoint responds with a redirect, Zammad would automatically follow up with a GET request. This behavior could be exploited by attackers to initiate GET requests to internal network resources. This vulnerability has now been addressed.

📖 For more details, please refer to the Security Advisory ZAA-2025-01.

Incorrect Access Control

When changing their two-factor authentication configuration, users must re-authenticate using their current password. Previously, this was enforced only on the frontend and not validated via the API. This security gap has since been closed.

📖 For more details, please refer to the Security Advisory ZAA-2025-02.

Incorrect Access Control to Article Drafts

Shared article drafts are meant to be visible only to agents. However, logged-in customers were able to see and manipulate draft information for their tickets via the browser console and API. This unintended access has been blocked.

📖 For more details, please refer to the Security Advisory ZAA-2025-03.

Incorrect Access Control

An agent with general knowledge base permissions was previously able to fetch content via the API that they were not explicitly authorized to access. The underlying permission checks have now been corrected to enforce proper restrictions.

📖 For more details, please refer to the Security Advisory ZAA-2025-04.

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisories

• ZAA-2025-01
• ZAA-2025-02
• ZAA-2025-03
• ZAA-2025-04

Download Zammad 6.4.2

All improvements can be found in the Changelog.

Packages

• Ubuntu / Debian
• OpenSUSE / SLES
• CentOS / RHEL
• Docker-Compose

Source code

• ftp.zammad.com/zammad-6.4.2.tar.bz2 (f5d9965a036010d151e0229561d79a6a)
• ftp.zammad.com/zammad-6.4.2.tar.gz (333067a44ec600e18bfef8bbce2cc0ed)
• ftp.zammad.com/zammad-6.4.2.zip (0fecdd8f4d14b3a0c2d10d1089339bb9)

Upgrade

Here you can find information on upgrading your Zammad installation:

• With Package
• From source
• With Docker

Original source

In this article

1. 🌍 Language Detection for Better Customer Experience
2. 📬 Connect Microsoft 365 via GraphAPI
3. 🔐 Seamless Logins with OpenID Connect
4. 🛠️ Better Admin Experience with Enhanced Search & Pagination
5. 🚨 Important note on the update
6. ⚠️ Breaking Changes
7. 📣 Important Announcements
8. Technical Requirements
9. Advisories
10. Download Zammad 6.5

🎥 Prefer watching to reading?

No problem – our SysAdmin will guide you through what’s new in Zammad 6.5 in his latest YouTube video. Nerd talk included! 👉 Watch the video here!

1. 🌍 Language Detection for Better Customer Experience

Zammad now detects the language of incoming tickets — offering a new level of multi-language support.
Whether it’s sending auto-replies in the corresponding language or routing tickets to the right team, this new feature helps you deliver more personalized and efficient customer service.

Use Cases:

• Trigger auto-replies based on message language
• Route tickets to language-specific agent groups
• Search and filter tickets by language

🧠 Each article now includes a language attribute you can use in triggers, schedulers, and more. For more detailed instructions and information, please refer to the admin documentation.

💡 Curious how language detection improves your customer support?
Explore the benefits in our blog post: Using Automatic Language Detection for Better Customer Experience

2. 📬 Connect Microsoft 365 via GraphAPI

Microsoft is moving away from IMAP — and with Zammad 6.5, you can too.
You can now connect your Microsoft 365 (formerly Office 365) mailboxes to Zammad using the GraphAPI. It’s a modern, secure alternative to IMAP, offering better performance, improved support for shared mailboxes, and seamless integration — especially in environments where IMAP is restricted or disabled.

Why switch to GraphAPI?
Compared to the traditional IMAP-based connection, GraphAPI offers several key benefits:

• Better support for shared mailboxes — fewer licenses required
• Folder selection made easy — choose inbox folders via a clear tree view
• Modern and scalable — GraphAPI is Microsoft’s recommended approach
• Secure by design — OAuth-based and aligned with Microsoft best practices

Our recommendation:
If you’re unsure which method to choose, go with the GraphAPI channel — it’s the more robust and future-ready option.
👉 Setup instructions and all details are available in our admin documentation.

3. 🔐 Seamless Logins with OpenID Connect

OpenID Connect is a simple and secure way to let users log in with an existing account from a trusted provider. In Zammad 6.5, you can now connect your OpenID Provider (OP) — such as Keycloak — as a Single Sign-On (SSO) method.
In this setup, Zammad acts as the Relying Party (RP), while the OpenID Provider is the identity service you either host or subscribe to. This makes user management easier, improves login security, and offers a streamlined experience for your team.
Set it up once and enjoy smoother logins across the board — with automatic logout sync included.
👉 Find setup instructions and all the details in our admin documentation.
💛 A special thank you to Ostfalia University of Applied Sciences for generously sponsoring this feature!

4. 🛠️ Better Admin Experience with Enhanced Search & Pagination

Managing hundreds of users, groups, or macros? We've got your back. This release adds search bars and pagination to the most heavily-used sections of the admin interface, making navigation faster and more intuitive — even in large-scale environments.

Improvements in:

• Users (pagination)
• Groups, Roles, Organizations (search bar)
• Overviews, Text Modules, Macros, Templates (search bar)
• Global Search Details → Search (pagination)

📚 Pagination now follows a clearer pattern: 1 2 3 [4] 5 6 > 500
🎁 Bonus effect: The global search also benefits from this change - the results list is no longer limited to 50 entries. Admins and agents can now browse through all hits as far as the eye can see.

Are you waiting for a certain feature? 🤨
If you're missing something, we're sorry to hear that. Our list of feature requests is very long and ever-growing. In order to speed up the process and put your favorite feature on the fast track, by becoming a Feature Sponsor. Just reach out to us and let's make it happen!

🚨 Important note on the update

The new search in the admin interface requires that the Elasticsearch index (if used) be rebuilt after the update. You can find detailed instructions here!

⚠️ Breaking Changes

For those that are not able to update to 6.5 sameday (because of larger API-changes), we’re providing version 6.4.2. This version includes the security fixes from 6.5 but does not contain the new feature updates. Click here to view the 6.4.2 Release Notes.

Textarea object manager attribute values

When used as template variables, the textarea object manager attributes are now replaced with an HTML representation of their value. This is a consequence of a bugfix for #5330, which expects newline characters are respected for these attributes in all contexts, including the rich text article body. The administrators are advised to check for usage of such variables in their objects (e.g. triggers, text modules, etc), by making sure the new value type will not break their existing workflows.

Changes to search API endpoints

All search endpoints (/:object/search) have been revised, extended and unified. This will also result in breaking changes in the existing endpoints. Be prepared that the structure in the responses may change (have a look at the API documentation where you can find updated examples).
The standard search (e.g. /ticket/search) returned a hash for some objects, such as the ticket. This will no longer be the case.
The structure for the expanded search (e.g. /ticket/search?expand=true) remains the same.
The structure of the full search (e.g. /ticket/search?full=true) remains the same, but is supplemented by a total_count, which counts all results.
Some objects used an object-related hash key, such as ticket_ids. This is now always record_ids.
The count search (e.g. /ticket/search?only_total_count=true) is a new feature.

Limit to one merged state

It will not be possible to have more than one state of the merged type. Additional states will be changed to the closed type automatically with that update. If you want to prevent that, make sure to only have one state of the type merged before you make an update to the next release.

APP_RESTART_CMD and Zammad self-shutdown

Zammad will now cause a self-shutdown of all running processes after certain configuration changes by default. It is the responsibility of the controlling process manager (e.g. Docker, Kubernetes, systemd) to bring them up again by way of a proper restart policy. This is the default for vanilla Docker, Kubernetes or Package deployments of Zammad.
The previous environment variable APP_RESTART_CMD is not supported any more.
For systems where this behaviour is not wanted, it can be disabled by setting the Zammad Setting auto_shutdown to false.

nginx config needs to be updated

Please update your nginx configuration file to insert the line
proxy_set_header Host $http_host;
to the location /ws and location /cable sections like in the example below:

📣 Important Announcements

Twitter/X Integration Removal

Due to the unclear situation regarding Twitter/X APIs, we consider removing the Twitter/X integration with the release of Zammad 7.0. Please have a look here for more information and updates on this topic.

Note about MySQL deprecation

Zammad is designed to provide our users with a secure and stable platform that is convincing in its performance. For this, the choice of supported database systems is crucial. After long discussions and based on our long experience, we have decided that Zammad will only support PostgreSQL as a database in the future. However, this change will not take effect until Zammad 7.0.
Until then, we do not recommend new installations with MySQL/MariaDB. Existing systems will continue to be supported, but must be migrated to PostgreSQL until the release of Zammad 7. For this purpose, we have provided a detailed Migration Guide that can be used to migrate existing systems to PostgreSQL free of charge.
This decision was not easy for us. However, we see it as necessary, because we want to continue to provide you with a long-term and reliable platform and keep the effort for everyone within limits.

Slack Integration Deprecation

Starting with Zammad version 7.0, we will no longer support this particular Slack integration. It is recommended that you switch to pre-built webhooks instead, a new feature of ours. Existing Slack integrations should be migrated manually before this feature is discontinued.

Support for Internet Explorer 11

As of Zammad version 7.0, Internet Explorer 11 is no longer supported.

Support for Centos 8 and Ubuntu 20.04

Due to an upcoming Ruby update, the next version of Zammad will no longer provide binary packages for Centos 8 and Ubuntu 20.04. We recommend that all users upgrade their operating system in a timely manner. Click here for information on supported distributions!

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisories

ZAA-2025-01
ZAA-2025-02
ZAA-2025-03
ZAA-2025-04

Download Zammad 6.5

All improvements can be found in the Changelog.

Packages

• Ubuntu / Debian
• OpenSUSE / SLES
• CentOS / RHEL
• Docker-Compose

Source code

• ftp.zammad.com/zammad-6.5.0.tar.bz2 (bb57d5c2344bf31898514065339eec54)
• ftp.zammad.com/zammad-6.5.0.tar.gz (390064bcfddaf16b086f54e059addf51)
• ftp.zammad.com/zammad-6.5.0.zip (1c9af3b09f24d9e08ad8f8f6320c694a)

Upgrade

Here you can find information on upgrading your Zammad installation:

• With Package
• From source
• With Docker

Original source

Security Release

Zammad 6.4.1

December 5, 2024 · This release note provides a very important security patch. All self-hosted instances must be updated immediately.

Please read on for details:

In this article

• Security Patch 🔐
• 🚨 Important Announcements
• Technical Requirements
• Advisory
• Download Zammad 6.4.1

Security Patch 🔐

Zammad stores its configuration settings in the database, and changes to these settings are logged for auditing purposes. Previously, all setting values—including sensitive data such as tokens and secrets—were included in the log entries. This has now been changed to ensure sensitive settings are filtered out, so their actual values are no longer logged.

🚨 Action required: Administrators are advised to review log files, backups and any systems that process log data and take appropriate action to secure or remove sensitive information.

📖 For more details, please refer to the Security Advisory:

ZAA-2024-05

Note:

🏠 Self-hosted users: Please update to version 6.4.1 immediately to ensure your system remains secure.

☁️ Hosted customers do not have to take any actions, the issue has been resolved on SaaS already.

🚨 Important Announcements

Unified Search Endpoints

With the next release, all search endpoints (/:object/search) will be revised, extended and unified. This will also result in breaking changes in the existing endpoints. Full details will be outlined in the upcoming release notes.

Changes to Merged States in Next Release

In the upcoming release, having more than one state of the "merged" type will no longer be supported. Additional states will be changed to the closed type automatically with that update. If you want to prevent that, make sure to only have one state of the type merged before you make an update to the next release.

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisory

ZAA-2024-05

Download Zammad 6.4.1

All improvements can be found in the

Changelog

.

Source code

• ftp.zammad.com/zammad-6.4.1.tar.bz2 (51f80548eb6727864dff066efb9a7ae9)
• ftp.zammad.com/zammad-6.4.1.tar.gz (bca4973ec291530ed0ad2e6d28e6bc70)
• ftp.zammad.com/zammad-6.4.1.zip (c0bcfa3bd525f7d87f3ccba4d4c21229)

Packages

• CentOS
• Debian
• Ubuntu
• Docker-Compose

Upgrade

Here you can find information on upgrading your Zammad installation:

• From source
• With RPM
• With DEB

Original source

Minor Release

Zammad 6.4

November 6, 2024 · Your favourite support ticketing system just got even better. Zammad 6.4 comes with features you've been waiting for. With Checklists, new keyboard shortcuts, and the ability to subscribe or unsubscribe to multiple tickets in one go, you'll enjoy a more streamlined and productive workflow!

In this article

1. ✅ Built-in Checklists for Streamlined Task Management
2. ⌨️ New Keyboard Shortcuts for Consistent Cross-Browser Functionality
3. 🔄 Bulk Subscribe/Unsubscribe with Macros, Triggers or Automation
4. Clean MFA Configuration for LDAP-Only Setups

• Breaking Changes
• 🚨 Important Announcements
• Technical Requirements
• Download Zammad 6.4

1. ✅ Built-in Checklists for Streamlined Task Management

Say hello to Checklists in Zammad! This powerful addition brings structured task management directly into your support workflow—whether you’re dealing with complex processes involving several steps or just need to check off a few routine tasks, this feature makes it easy to stay organized without switching between tools.

What’s more? Checklist items can be linked to related tickets and Zammad’s automation takes it from there: when a linked ticket is closed, the corresponding checklist item is automatically marked complete. This smart integration reduces manual updates and ensures every task is handled with accuracy, giving you peace of mind that nothing is overlooked.

Admins can easily activate this feature and create customizable checklist templates in the admin interface, tailoring checklist items to suit various workflows—from onboarding to troubleshooting technical issues.

The Checklist feature is accessible for agents in the right sidebar under the "Checklist" tab. Please note that only users with edit permissions for the ticket can add or modify checklist items.

Screenshots

Want to get started? Check out our admin documentation for detailed setup instructions.

Acknowledgment 💛

Thank you to our sponsors for the generous support in developing this feature:

• 🙏🏻 Hellberg Consulting e.K.
• 🙏🏻 Urban GmbH
• 🙏🏻 Alarm Dispatcher Systems GmbH
• 🙏🏻 rami.io GmbH
• 🙏🏻 FWU – Das Medieninstitut der Länder
• 🙏🏻 Sander Gruppe

2. ⌨️ New Keyboard Shortcuts for Consistent Cross-Browser Functionality

The days of keyboard shortcuts conflicting with system or browser commands are officially behind us. With Zammad 6.4, we've introduced a new set of keyboard shortcuts that work seamlessly across all major browsers—Chrome, Firefox, Safari, and Edge—while ensuring consistent behavior across Windows, macOS, and Linux.

We've carefully selected intuitive combinations that are easy to remember and to use, so you can confidently navigate Zammad without worrying about unexpected issues. Whether you’re navigating tickets, performing quick actions or editing messages, these new keyboard shortcuts will not only take power users to the next level of efficiency.

Ready to speed up your workflow? Press ? while in Zammad to see the full keyboard shortcut reference guide.

3. 🔄 Bulk Subscribe/Unsubscribe with Macros, Triggers or Automation

Managing ticket subscriptions individually can be a hassle—whether it’s unsubscribing from multiple tickets where you’ve been mentioned or subscribing to new or unassigned ones. Zammad 6.4 now streamlines this process with bulk action capabilities, letting you update your subscriptions efficiently without opening each ticket one by one.

How to activate it: Admins can enable this feature in the Zammad admin interface by configuring triggers, macros or the scheduler. This setup ensures that the functionality is tailored to your team’s specific needs, whether it’s for decluttering ticket views or staying informed on key issues.

Here’s how it works: Agents can use drag-and-drop functionality directly from their overview. Simply select the tickets you want to update, drag them to the designated macro and instantly subscribe or unsubscribe from all selected tickets. No more cycling through tickets individually.

4. Clean MFA Configuration for LDAP-Only Setups

For teams using LDAP as their sole authentication method, it’s recommended to disable local password changes for users. Previously, doing so meant MFA also had to be disabled.

With separate controls for password changes and MFA, LDAP-only setups can now keep MFA enabled while blocking local password changes, providing stronger security and better customization.

See the admin documentation for configuration details.

Are you waiting for a certain feature? 🤨

If you're missing something, we're sorry to hear that. Our list of feature requests is very long and ever-growing. In order to speed up the process and put your favorite feature on the fast track, by becoming a Feature Sponsor. Just reach out to us and let's make it happen!

Breaking Changes

JavaScript Package Manager Change

This version changes the JavaScript toolchains to be based on pnpm rather than yarn. This is only relevant for source installations, where you need to provide a recent version of pnpm in order to run the assets:precompile command.

Changed CSV-format for user/organization import/export

We slightly changed the format of the CSV-files you use for importing/exporting users and organizations. If you somehow do that in an automated process via our REST-API, you will need to review that process before updating to Zammad 6.4. Check the details in our documentation.

🚨 Important Announcements

Twitter/X Integration Removal

Due to the unclear situation regarding Twitter/X APIs, we consider removing the Twitter/X integration with the release of Zammad 7.0. Please have a look here for more information and updates on this topic.

Note about MySQL deprecation

Zammad is designed to provide our users with a secure and stable platform that is convincing in its performance. For this, the choice of supported database systems is crucial. After long discussions and based on our long experience, we have decided that Zammad will only support PostgreSQL as a database in the future. However, this change will not take effect until Zammad 7.0.

Until then, we do not recommend new installations with MySQL/MariaDB. Existing systems will continue to be supported, but must be migrated to PostgreSQL until the release of Zammad 7. For this purpose, we have provided a detailed Migration Guide that can be used to migrate existing systems to PostgreSQL free of charge.

This decision was not easy for us. However, we see it as necessary, because we want to continue to provide you with a long-term and reliable platform and keep the effort for everyone within limits.

Slack Integration Deprecation

Starting with Zammad version 7.0, we will no longer support this particular Slack integration. It is recommended that you switch to pre-built webhooks instead, a new feature of ours. Existing Slack integrations should be migrated manually before this feature is discontinued.

Support for Internet Explorer 11

As of Zammad version 7.0, Internet Explorer 11 is no longer supported.

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Download Zammad 6.4

All improvements can be found in the Changelog.

Source code

ftp.zammad.com/zammad-6.4.0.tar.bz2 (334e31c2ca2d1295359264eb67e2cbce)

ftp.zammad.com/zammad-6.4.0.tar.gz (6d1de0b9e3856474d0489381968a5c4c)

ftp.zammad.com/zammad-6.4.0.zip (c3d0d0064fa674d300d6121f37dd8d5c)

Packages

CentOS

Debian

Ubuntu

Docker-Compose

Upgrade

Here you can find information on upgrading your Zammad installation:

From source

With RPM

With DEB

Original source

Security Release

Zammad 6.3.1

May 15, 2024 · This release note includes a very important security patch. All self-hosted instances should be updated immediately.
Please read on for details:

In this article

• Security Patch 🔐
• Technical Requirements
• Advisory
• Download Zammad 6.3.1

Security Patch 🔐

A Ruby gem bundled by Zammad was installed with world-writable file permissions. This allowed a local attacker to modify these files and inject arbitrary code into the Zammad processes running with the Zammad user's environment and permissions.
Find the Advisory here:
ZAA-2024-04

In addition, the Ruby version in use has been updated from version 3.2.3 to 3.2.4 due to a security release.

Note:

🏠 If you're using Zammad on-premise please update to 6.3.1 as soon as possible. The Ruby 3.2.4 security update must also be carried out locally for source code installations.

☁️ Hosted instances will be updated automatically, so there is no action required from your side.

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisory

ZAA-2024-04

Download Zammad 6.3.1

All improvements can be found in the
Changelog
.

Source code

ftp.zammad.com/zammad-6.3.1.tar.bz2 (60322ce57d9e198fd45d81fc4861ab97)
ftp.zammad.com/zammad-6.3.1.tar.gz (16524e29b35b029781253a5c71f7912f)
ftp.zammad.com/zammad-6.3.1.zip (ca3194b847504a6beb01554e47d2b4a7)

Packages

• CentOS
• Debian
• Ubuntu
• Docker-Compose

Upgrade

Here you can find information on upgrading your Zammad installation:

• From source
• With RPM
• With DEB

Original source

In this article

1. 💬 WhatsApp Business Channel
2. 🏷️ Custom Ticket States & Priority
3. 🔤 Translation Management Improvements

🌟Coming next: Improved Shortcuts

Breaking Changes

🚨 Important Announcements

Technical Requirements

Advisories

Download Zammad 6.3

1. 💬 WhatsApp Business Channel

Ready to level up your omnichannel communication? 🆙 With Zammad 6.3, you can integrate your instance with a WhatsApp Business account. This feature unlocks new possibilities for interacting with customers where they are and delivering seamless support.

Please review the prerequisites and limitations of this feature carefully, and follow our detailed tutorial to prepare your setup effectively. Learn more in our admin documentation.

Note: WhatsApp Cloud API is mandatory for connecting the messenger to Zammad. Using the WhatsApp Business App alone will not enable integration.

Acknowledgment

Many thanks to our sponsor Skoda Autohaus Melzer for the generous support in developing this feature! 🙏🏻

Discover more about how integrating an omnichannel strategy can elevate your customer service experience. Visit our blog for insightful articles on omnichannel strategies and the role of WhatsApp in customer service.

2. 🏷️ Custom Ticket States & Priority

Zammad's simplicity is one of its strengths. However, we recognize that some scenarios demand a more tailored approach. That’s why, with Zammad 6.3, we’ve introduced enhancements that allow for greater customization of ticket states and priorities, thus providing users with more control and flexibility.

Use Case Example: When waiting on different parties like customers or vendors, the "pending reminder" status may be too vague. To address this, creating a specific status such as "waiting on vendor" can streamline the ticket management process. Similarly, the ability to customize ticket priorities allows teams to precisely assess the urgency of issues, thus optimizing response times and resource allocation for enhanced workflow efficiency.

You can add, disable or change states and priorities through the admin interface. Simply navigate to "Settings > Tickets" to access the ticket states or priorities management. For more detailed instructions and information, please refer to the admin documentation. ⬅️

Important note: Please inform yourself beforehand about the correct use/philosophy of status. Incorrect configuration can lead to unwanted secondary behavior. You are also welcome to attend user admin training to learn more.

3. 🔤 Translation Management Improvements

In Zammad 6.3, we have improved translation management to give you the flexibility to manage translations specific to your helpdesk environment. This improvement to the UI allows you to customize any translation locally, even if it is not initially provided by the system. Translation is supported for a broad number of features, including but not limited to custom:

• Object Attributes
• Ticket Macros
• Ticket Overviews
• Ticket Priorities
• Ticket States

➡️ Within the translation screen, simply click on the New Translation button. Read more on Customizing Translations in the admin documentation.

🌟Coming next: Improved Shortcuts

Based on feedback from many of our users, we're excited to announce that our next release will include a new set of keyboard shortcuts. Don't worry, you can switch back and forth between the new and old set so you can explore and get used to them at your own pace.

Are you waiting for a certain feature? 🤨

If you're missing something, we're sorry to hear that. Our list of feature requests is very long and ever-growing. In order to speed up the process and put your favorite feature on the fast track, by becoming a Feature Sponsor. Just reach out to us and let's make it happen!

Breaking Changes

Knowledge base granular permissions setup was changed.

Zammad allows configuration of a granular permission structure for knowledge base access. Previous Zammad versions allowed to misconfigure this in cases of allowing agents editor access to only some, but not all categories: it was possible to grant editor access at a higher level in the category tree, and then restricting access to reader or none for sub-categories. This was not effective due to permission inheritance.

Such a misconfiguration is no longer possible in Zammad 6.3. Administrators with existing knowledge base granular permission structures should review their configuration to ensure that at top-level only reader access is granted, and editor access only for the relevant sub-categories.

Permissions for Ticket State and Priority REST-API

With this release, we will introduce new permissions for the ticket state and priority management. It will no longer be possible to access the corresponding REST-API with "admin.object" permission. Existing roles and/or access tokens that are used for these specific REST-API endpoints need to be updated to include the new permissions ("admin.ticket_state" and "admin.ticket_priority").

🚨 Important Announcements

Twitter/X Integration Removal

Due to the unclear situation regarding Twitter/X APIs, we consider removing the Twitter/X integration with the release of Zammad 7.0. Please have a look here for more information and updates on this topic.

Note about MySQL deprecation

Zammad is designed to provide our users with a secure and stable platform that is convincing in its performance. For this, the choice of supported database systems is crucial. After long discussions and based on our long experience, we have decided that Zammad will only support PostgreSQL as a database in the future. However, this change will not take effect until Zammad 7.0.

Until then, we do not recommend new installations with MySQL/MariaDB. Existing systems will continue to be supported, but must be migrated to PostgreSQL until the release of Zammad 7. For this purpose, we have provided a detailed Migration Guide that can be used to migrate existing systems to PostgreSQL free of charge.

This decision was not easy for us. However, we see it as necessary, because we want to continue to provide you with a long-term and reliable platform and keep the effort for everyone within limits.

Slack Integration Deprecation

Starting with Zammad version 7.0, we will no longer support this particular Slack integration. It is recommended that you switch to pre-built webhooks instead, a new feature of ours. Existing Slack integrations should be migrated manually before this feature is discontinued.

Support for Internet Explorer 11

As of Zammad version 7.0, Internet Explorer 11 is no longer supported.

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisories

ZAA-2024-01

ZAA-2024-02

ZAA-2024-03

Download Zammad 6.3

All improvements can be found in the Changelog.

Source code

ftp.zammad.com/zammad-6.3.0.tar.bz2 (70f34df1217196e5aaba5e29b8fd7d55)

ftp.zammad.com/zammad-6.3.0.tar.gz (87aa73b23b9b2d2353229f9586d11160)

ftp.zammad.com/zammad-6.3.0.zip (5c50fbadd532ab89243fa23ded8ab4dc)

Packages

CentOS

Debian

Ubuntu

Docker-Compose

Upgrade

Here you can find information on upgrading your Zammad installation:

From source

With RPM

With DEB

Original source