Zammad 6.5.5 is an exceptional security release addressing a critical vulnerability in the unsupported 6.5 series. It provides an emergency fix for customers who cannot immediately upgrade to a supported version.

Below, you’ll find the key details and recommended actions.

Zammad 6.5.5 provides an emergency security fix by hardening the WebSocket server code to address CVE-2026-102489.

⚠️ Important note: Zammad 6.5.5 is only available through a new package repository. Administrators must switch to this repository before updating. Please follow the repository migration instructions.

Please note: Zammad 6.5 has reached end of support. This exceptional release is intended as a temporary security measure and does not extend its support lifecycle.

Action Required

• Zammad 6.5 users: Update to Zammad 6.5.5 immediately if upgrading to Zammad 7.2.2 is not yet possible.
• All self-hosted users: We strongly recommend upgrading to Zammad 7.2.2 as soon as possible.
• Zammad SaaS customers: No action is required.

📣 Important Announcements Regarding Upcoming Releases

String#utf8_encode and Object#to_utf8 will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#stringutf8_encode-and-objectto_utf8-will-be-removed

Debian 11 will no longer be supported

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#debian-11-will-no-longer-be-supported

Inline attachments will be listed separately in ticket article API responses

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#inline-attachments-will-be-listed-separately-in-ticket-article-api-responses

Exceptions::UnprocessableEntity will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#exceptionsunprocessableentity-will-be-removed

The deprecated Rails.application.config.db_* values will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#the-deprecated-railsapplicationconfigdb_-values-will-be-removed

String#utf8_encode and Object#to_utf8 will be deprecated in favour of TextEncoding.utf8_encode

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#stringutf8_encode-and-objectto_utf8-were-deprecated-in-favour-of-textencodingutf8_encode

Import mode will also enable maintenance mode

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#import-mode-also-enables-maintenance-mode

Deleting organizations via API will require the admin.organization permission

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#deleting-organizations-via-api-requires-the-adminorganization-permission

Original source

Zammad 7.2.2 is an important security update. It addresses a vulnerability that only affects DEB/RPM packages (packager.io).

Below, you’ll find all relevant information about the update and the required steps.

Recommended Resolution

SaaS Customers:

No action is required. Your instances are not affected.

Self-Hosted Installations:

We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• Local privilege escalation to root in DEB/RPM packages (packager.io): The vulnerability only affects installations using DEB/RPM packages and, under certain local conditions, could allow user privileges to be escalated.

📣 Important Announcements Regarding Upcoming Releases

• String#utf8_encode and Object#to_utf8 will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#stringutf8_encode-and-objectto_utf8-will-be-removed

• Debian 11 will no longer be supported

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#debian-11-will-no-longer-be-supported

• Inline attachments will be listed separately in ticket article API responses

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#inline-attachments-will-be-listed-separately-in-ticket-article-api-responses

• Exceptions::UnprocessableEntity will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#exceptionsunprocessableentity-will-be-removed

• The deprecated Rails.application.config.db_* values will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#the-deprecated-railsapplicationconfigdb_-values-will-be-removed

• String#utf8_encode and Object#to_utf8 will be deprecated in favour of TextEncoding.utf8_encode

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#stringutf8_encode-and-objectto_utf8-were-deprecated-in-favour-of-textencodingutf8_encode

• Import mode will also enable maintenance mode

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#import-mode-also-enables-maintenance-mode

• Deleting organizations via API will require the admin.organization permission

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#deleting-organizations-via-api-requires-the-adminorganization-permission

Original source

Zammad 7.2.1

Zammad 7.2.1 is an important security update that addresses critical vulnerabilities. Below you will find all the relevant information about the update and the required steps.

Recommended Resolution

SaaS Customers:

No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations:

We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• Unfiltered sign-up and ticket update fields allow cross-organization ticket disclosure and takeover
• Multi-factor authentication could be bypassed through the email verification flow
• Remote code execution via template sanitizer bypass in automation configuration
• Stored XSS in desktop autocomplete fields via unescaped option label
• Stored XSS in ticket zoom via attacker-controlled article preferences
• Arbitrary configuration disclosure via recent view endpoint
• Deactivated roles still granted knowledge base editor access
• Session identifier disclosed in authenticated configuration response enabled off-host session takeover
• Knowledge base reordering, publishing and administration possible without the required permission
• Second-order SQL injection in ticket overview sorting
• Inactive sessions remain authorized over ActionCable GraphQL
• Missing authorization on ticket articles can expose article content to unauthorized users
• Customer-visible ticket update responses leak unredacted user and organization data
• Activity stream disclosed content of tickets moved out of an agent's groups
• Channel administration APIs return stored channel credentials in clear text
• Password reset endpoint disclosed whether an account existed via response timing
• Stored HTML injection in Knowledge Base video widget rendered inside Zammad enables forced session switching
• Deactivated roles still granted ticket group access in overviews and search
• Group configuration and email address disclosure to authenticated users via getting started endpoint
• Disclosure of names of users from other organizations to customers
• Ticket link list disclosed the existence and relation of tickets outside the user's permission scope
• Ticket data of no-longer-accessible tickets disclosed to agents via online notification API
• Unscoped GraphQL template query and subscription bypass TemplatePolicy scope
• Stored XSS in desktop tree select fields via whitespace-only filter
• Group collection push disclosed full group records to any authenticated session
• Forward quote header discloses agent email addresses
• Clipboard HTML injection via unescaped user and organization display name

Important Announcements

String#utf8_encode and Object#to_utf8 will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#stringutf8_encode-and-objectto_utf8-will-be-removed

Debian 11 will no longer be supported

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#debian-11-will-no-longer-be-supported

Inline attachments will be listed separately in ticket article API responses

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#inline-attachments-will-be-listed-separately-in-ticket-article-api-responses

Exceptions::UnprocessableEntity will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#exceptionsunprocessableentity-will-be-removed

The deprecated Rails.application.config.db_* values will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#the-deprecated-railsapplicationconfigdb_-values-will-be-removed

String#utf8_encode and Object#to_utf8 will be deprecated in favour of TextEncoding.utf8_encode

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#stringutf8_encode-and-objectto_utf8-were-deprecated-in-favour-of-textencodingutf8_encode

Import mode will also enable maintenance mode

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#import-mode-also-enables-maintenance-mode

Deleting organizations via API will require the admin.organization permission

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#deleting-organizations-via-api-requires-the-adminorganization-permission

Original source

Zammad 7.2 enhances security, administration and knowledge management. At the heart of the release is the new tamper-proof Admin Audit Log, making administrative changes easy to trace and review. This release also introduces greater spam protection, finer control over AI usage and costs, and new AI-powered features for capturing, retrieving, and reusing knowledge base answers.

Want to see the new features in action? Join our release webinar or let Marcel—aka “That Helpdesk Guy”—walk you through the highlights in his latest video on YouTube.

1. Security & Compliance

🛡️ Tamper-Proof Admin Audit Log

Who changed which setting, and when? Especially in larger Zammad environments, having a clear answer to this question isn't just helpful for troubleshooting—it's vital for IT security, internal controls, and external audits.

With version 7.2, we are introducing an audit log for administrative actions. Changes made in the admin area are recorded in a tamper-proof way and can be fully traced. As with the ticket history, these entries cannot be edited or deleted — either through the user interface or via the API.

The audit log is much more than just a record of administrative changes. It provides a reliable basis for demonstrating accountability and control processes to auditors. Along with Zammad's ISO/IEC 27001:2022 certification and SOC 2 Type I, it establishes an even stronger foundation for security and compliance.

👉 Find all the details in our Zammad Admin documentation on Audit Logs.

🚫 Better Spam Protection for Web Forms

Your contact forms are meant to bring in genuine customer inquiries—not create hundreds of spam tickets.

That's why Zammad 7.2 comes with upgraded spam protection framework for web forms. The goal: reliably catch both automated bot submissions and repeated manual spam long before they clutter your agents' queues.

The new modular architecture supports a variety of spam-checking methods and providers. This allows administrators to choose the exact solution that best fits their privacy, security, and infrastructure requirements.

👉 For setup details, check out our Zammad Admin documentation on Spam Protection.

2. Knowledge Base

📚 Turn Solved Tickets into KB Answer Drafts

Some of the best solutions are born directly in customer support—only to end up buried once a ticket is closed. Turning those into knowledge base answers takes extra time, and gets pushed down the to-do list during busy shifts.

Zammad 7.2 makes knowledge retention now part of the support workflow. With the help of AI agents, KB admins and support agents with editor rights can now generate a draft answer directly from a solved ticket, ready to be reviewed, refined, and expanded. Before creating a new entry, AI agent checks whether related answers already exist in the knowledge base. If it finds any, agents can decide whether a new draft is still needed.

The AI agent creates new answers as drafts in the knowledge base’s default language and automatically links them to the original ticket. AI-generated content is also tagged with ai-generated. The AI selects an appropriate category from those the respective agent has permission to edit.

⚠️ Important: The quality of the draft depends on how clearly the solution is documented in the ticket. The more relevant context, steps, and notes it contains, the more accurate and complete the AI-generated draft will be. If key information is missing or the resolution is only briefly documented, the draft will reflect these gaps and may require manual refinement. In this case, the knowledge base author will need to add any missing context.

👉 Learn more in our Zammad Admin documentation on Knowledge Base Answer AI Generation.

🔎 Get KB Answers Suggestions in Seconds

As a knowledge base grows, finding and identify the right answer for a specific issue can take time.

Zammad 7.2 introduces a new AI-powered feature that uses semantic search to compare existing knowledge base answers with the content of a ticket. If an answer meets the relevance threshold defined by an administrator, Zammad displays it directly in the ticket sidebar under Suggested Knowledge.

Agents can open and review the suggested answers right from there. If one of them helps resolve the ticket, it can be permanently linked to the ticket.

⚠️ Important: The quality of the suggestions depends on how well maintained and up-to-date your knowledge base is. Semantic search measures the similarity between ticket content and existing knowledge base answers, displaying a percentage match score for each suggestion. The more comprehensive and relevant your knowledge base content is, the more accurate the suggestions will be.

Combined with the new capability to draft knowledge base content from solved tickets, this creates a continuous knowledge cycle: Solutions from support flow into the knowledge base and become available to agents exactly where they are needed.

👉 Dive into the details in our Zammad Admin documentation on Knowledge Base Answer Suggestions.

🎬 Embed Self-Hosted Videos in KB Answers

Some things are easier to explain in a video than in text. While Zammad already supports embedding videos from platforms like YouTube and Vimeo, version 7.2 expands this capability to include self-hosted video content.

Organizations can now host video files from their own internal or external media streaming servers and embed them directly into knowledge base answers.

These changes give you full control over your content and data privacy without sacrificing a smooth, interactive video playback experience for your customers and agents.

For security reasons, administrators must approve media servers before they can be used. Read more in the Zammad Admin Documentation on Video Servers.

This feature was sponsored by wegscheider office solution GmbH. Thank you for your support! 💛

3. Administration & Usability

👤 Display Names the Way Your Organization Works

First Name Last Name? Last Name First Name? Or Last Name, First Name? What might sound like a minor detail actually makes a noticeable difference in daily support work—especially when scanning long user lists or working in organizations that primarily identify customers by last name.

Zammad 7.2 allows administrators to define the order of user names centrally. This feature makes it easier to align Zammad with your organization’s naming conventions and internal workflows.

The selected format is applied consistently throughout the Zammad interface, including in overviews, selection fields, and the ticket sidebar.

👉 For configuration details and available options, see our Zammad Admin documentation on User Name Format.

🔕 API Updates Without Unnecessary Notification Noise

APIs, triggers, and third-party integrations power amazing automated workflows. However, these features can also generate unnecessary notifications for agents during routine background updates.

Zammad 7.2 introduces the option to suppress these notifications. Third-party systems can now update ticket attributes quietly in the background without triggering unwanted email or in-app alerts.

This cuts down on notification fatigue for your support team, ensuring smooth and quiet processes across complex system integrations.

👉 See all available settings in our Zammad Admin documentation on Suppress Notifications.

This feature was sponsored by PicoQuant. Thank you for your support!

4. Zammad AI

🤖 Summary Selector for Better Usage & Cost Control

A quick ticket like "Hi, please reset my password" doesn't need an AI summary. To keep workflows efficient, it often makes more sense to enable this AI feature strictly for specific ticket types, priority levels, or specialized teams.

Zammad 7.2 introduces Summary Selector for this exact purpose. Administrators can define specific conditions based on state, priority, group, or custom fields to determine when AI summaries are available.

This helps you avoid unnecessary AI usage and cut associated API costs where a summary adds little value.

👉 Read more in our Zammad Admin documentation on AI Summary Selector.

🚨 Important note on the update

For the new Admin Audit Log, Elasticsearch must be reindexed after updating to Zammad 7.2. Please factor this additional step into your update process to ensure the Audit Log is fully available.

⚠️ Breaking Changes

Zammad's reverse proxy configuration is authoritative for the request scheme

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#zammads-reverse-proxy-configuration-is-authoritative-for-the-request-scheme

Links between an object and itself are rejected, and failed link creations answer 422

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#links-between-an-object-and-itself-are-rejected-and-failed-link-creations-answer-422

Dates with a year outside 1 to 9999 are no longer accepted

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#dates-with-a-year-outside-1-to-9999-are-no-longer-accepted

Import mode is reported as an issue by the health check

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#import-mode-is-reported-as-an-issue-by-the-health-check

Knowledge Base answers index a new publication_state field

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#knowledge-base-answers-index-a-new-publication_state-field

Elasticsearch 7 is no longer supported, 8.15 is the new minimum

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#elasticsearch-7-is-no-longer-supported-815-is-the-new-minimum

Local file paths are no longer supported as calendar iCal feed source

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#local-file-paths-are-no-longer-supported-as-calendar-ical-feed-source

The deprecated 'es-ca' locale was inactivated

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#the-deprecated-es-ca-locale-was-inactivated

The default Content-Security-Policy became stricter

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#the-default-content-security-policy-became-stricter

📣 Important Announcements

Deleting organizations via API will require the admin.organization permission

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#deleting-organizations-via-api-requires-the-adminorganization-permission

Debian 11 will no longer be supported

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#debian-11-will-no-longer-be-supported

Inline attachments will be listed separately in ticket article API responses

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#inline-attachments-will-be-listed-separately-in-ticket-article-api-responses

Exceptions::UnprocessableEntity will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#exceptionsunprocessableentity-will-be-removed

The deprecated Rails.application.config.db_* values will be removed

All details: https://github.com/zammad/zammad/blob/develop/BREAKING_CHANGES.md#the-deprecated-railsapplicationconfigdb_-values-will-be-removed

Original source

Recommended Resolution

SaaS Customers:

No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations:

We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• SSRF protection bypass via DNS rebinding in hostname safety check
• Arbitrary object disclosure via Core Workflow perform endpoint
• Cross-tenant attachment disclosure via inline images in notification emails
• Disclosure of external data source credentials to non-admin users via object attribute metadata
• Disclosure of group-restricted text modules to unauthorized agents
• Improper access control allows agents to read and modify other users' overview ordering preferences
• AI error messages can be turned into clickable links due to incorrect escaping order

📣 Important Announcements

Knowledge Base search index: new publication_state field

Zammad 7.2 will introduce a new publication_state field for KnowledgeBase::Answer::Translation as part of the new Suggested searches functionality in the Knowledge Base search. The field reflects an answer’s current state (draft, internal, published, or archived).

To make the new field available after upgrading to Zammad 7.2, the search index must be rebuilt:

zammad run rake zammad:searchindex:rebuild

Without rebuilding the index, queries such as publication_state:draft will return no results.

Calendar iCal feed must be a URL

Starting with Zammad 7.2, the functionality of using local file paths for calendars iCal feed source will be removed.

Deprecated es-ca locale inactivated

The deprecated es-ca locale for Catalan will no longer be offered for selection starting with Zammad 7.2. Users still set to es-ca will be automatically migrated to the proper ca locale. Existing Knowledge Base locales referencing es-ca will not be migrated automatically due to the URL change and must be updated manually.

Stricter default Content-Security-Policy

Starting with Zammad 7.2, the default Content-Security-Policy header will include a new frame-ancestors 'self' directive.

⚠️ Setups that currently allow the Zammad web interface to be embedded in an on a different origin by overriding the X-Frame-Options header at the reverse proxy will now be blocked again by the new frame-ancestors 'self' CSP directive. To re-enable embedding from trusted origins, the frame-ancestors directive of the Content-Security-Policy response header must be adjusted at the reverse proxy as well.

Original source

Security Release

Zammad 7.1.2

August 4, 2026 · Zammad 7.1.2 is an important security update that addresses critical vulnerabilities. Below you will find all the relevant information about the update and the required steps.

In this article

• Recommended Resolution
• 📣 Important Announcements
• Infos & Advisories / Downloads

Recommended Resolution

SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• AI Agent template sanitizer bypass leads to remote code execution
• S/MIME signature verification allows forged sender impersonation
• Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
• IDOR in External Data Source rendering exposes ticket, user, group, and organization data
• Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
• Missing article authorization in ticket attachment clone endpoint
• Pending upload deletion bypass via legacy attachment endpoint
• Account takeover via unverified email matching during SSO auto-link
• HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
• Stored XSS via unescaped option labels in the object attribute options context UI
• Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
• Missing rate limiting allows password brute-forcing during two-factor login
• Sensitive Information Exposure in Integration Administration API
• Microsoft Graph error logs expose partially masked OAuth access tokens
• Channel admins can read unauthorized attachments via signature rich-text body
• Authenticated agents can read AI summary error messages from inaccessible tickets
• Remote image tracking bypass via shortened URL scheme
• Stored XSS in ticket article rendering in the new Vue-based interface

📣 Important Announcements

Knowledge Base: New Search Index Field for Publication Status

Starting with Zammad 7.2, the search index for Knowledge Base answer translations includes the new publication_state field. This allows searches to be filtered by an answer’s current publication status:

• draft – draft
• internal – internal
• published – published
• archived – archived

This change is part of the new “Suggested Searches” feature in the Knowledge Base search.

To make the new field available after upgrading to Zammad 7.2, the search index must be rebuilt once:

zammad run rake zammad:searchindex:rebuild

Without rebuilding the search index, queries such as publication_state:draft will not return any results.

Calendar iCal feed must be a URL

Starting with Zammad 7.2, the functionality of using local file paths for calendars iCal feed source will be removed.

Deprecated es-ca locale inactivated

The deprecated es-ca locale for Catalan will no longer be offered for selection starting with Zammad 7.2. Users still set to es-ca will be automatically migrated to the proper ca locale. Existing Knowledge Base locales referencing es-ca will not be migrated automatically due to the URL change and must be updated manually.

Stricter default Content-Security-Policy

Starting with Zammad 7.2, the default Content-Security-Policy header will include a new frame-ancestors 'self' directive.

⚠️ Setups that currently allow the Zammad web interface to be embedded in an on a different origin by overriding the X-Frame-Options header at the reverse proxy will now be blocked again by the new frame-ancestors 'self' CSP directive. To re-enable embedding from trusted origins, the frame-ancestors directive of the Content-Security-Policy response header must be adjusted at the reverse proxy as well.

Original source

Security Release

Zammad 7.1.1 & 7.0.3

June 25, 2026 · We have released Zammad 7.1.1 and 7.0.3. These security updates address a critical vulnerability, and we highly recommend applying them to keep your helpdesk secure.
Read on for full details:

In this article

• Recommended Resolution
• 🚨 Important note on the update
• Infos & Advisories / Downloads

A vulnerability in the Sessions module has been successfully resolved. Due to a lack of input validation on the client_id parameter, an authenticated user could inject directory traversal sequences (../) to trigger a recursive deletion of arbitrary files and directories via FileUtils.rm_rf on the server. The deletion occurs as a side effect during session lookup (Sessions.get), before the controller returns any response and regardless of whether the lookup itself succeeds.

Recommended Resolution

SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

⚠️ Important Note: anyone still using version 7.0 needs to switch to the stable-7.0 branch to receive the latest update.

Vulnerabilities patched

• Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller: github.com/zammad/zammad/security/advisories/GHSA-xp9w-hhf3-vfxx

🚨 Important note on the update

Before updating, all self-hosted users with a package installation must migrate to the new package hosting by changing their repository configuration. The old repositories will only serve versions prior to 7.1.x and will be available for a short time before the service is shut down. For instructions on updating your package management, refer to the documentation.

Original source

Minor Release

Zammad 7.1

June 17, 2026 · This release helps you bring more structure to your support workflows while reducing manual effort. Turn incoming requests into clean, actionable data — with privacy at the core and control firmly in your hands.

In this article

• 🔍 Information extraction with regex
• 🎯 New AI Agent: Text Extractor
• 🏷️ New AI Agent: Ticket Tagger
• 🚨 Important note on the update
• 📣 Important Announcements
• Infos & Advisories / Downloads

From extracting specific values with regex to identifying information and adding tags with AI, Zammad 7.1 helps support teams capture the right information faster and keep ticket data structured from the start.

Want to see the features in action? Join our release webinar or let Marcel—aka “That Helpdesk Guy”—walk you through the highlights in his latest video on YouTube.

Join the Release Webinar
Watch Video from That Helpdesk Guy

🔍 Information extraction with regex

Sometimes, you really do need to find the needle in the haystack. External ticket numbers, order IDs, customer references, and other structured values are often hidden in the subject or message body of an email.

With Zammad 7.1, admins can now use regular expressions, or regex, in Postmaster filters to extract specific text from incoming emails and reuse it in filter actions. This makes it possible to automatically populate ticket attributes based on the content of an email.

Extracted values are made available in a structured namespace, such as regex.NAME, and can be used as placeholders in the action section of the Postmaster filter.

👉 Learn more in our admin documentation
regex in Postmaster filters

🎯 New AI Agent: Text Extractor

While regex is especially useful for clearly defined patterns, the new AI Agent for text extraction is designed to work with natural language. It can analyze incoming tickets and identify information such as contact names, product mentions, or invoice numbers — even when these details do not follow a consistent format.

The extracted information can be written into the corresponding ticket attributes automatically. This reduces manual data entry, improves data quality, and helps support teams work with structured, usable information from the moment a ticket arrives.

👉 Read all the details in our admin documentation
AI Text Extractor

🏷️ New AI Agent: Ticket Tagger

Well-placed tags make tickets easier to find, group, and analyze. They also provide an important basis for automation. In everyday support work, however, manual tagging can quickly fall behind — especially when ticket volume increases.

With Zammad 7.1, the new AI Agent for ticket tagging can automatically enrich incoming tickets with relevant tags. Whether there is a sudden increase in mentions of “app crashes” or a growing number of requests about “billing”, automatic tagging helps keep tickets structured, searchable, and ready for analysis, even as volume grows.

The result is cleaner ticket organization, better visibility into emerging trends, and more reliable workflows — even when things get busy.

👉 More in our admin documentation
AI Ticket Tagger

🚨 Important note on the update

Before updating, all self-hosted users with a package installation must migrate to the new package hosting by changing their repository configuration. The old repositories will only serve versions prior to 7.1 and will be available for a short time before the service is shut down. For instructions on updating your package management, refer to the documentation.
If you use the functionality for out-of-office replacements, we encourage to do a elasticsearch reindex.

📣 Important Announcements

Elasticsearch 7 support will end with Zammad 7.1

From Zammad 7.2 onward, Elasticsearch 7 will no longer be supported. Elasticsearch 8 or later will be required.

Calendar iCal feed must be a URL

Starting with Zammad 7.2, calendars can no longer be configured with a local file path as the iCal feed source. Only HTTP/HTTPS URLs are accepted.
⚠️ If you are currently using a local .ics file path, please host the file on an HTTP server and update the calendar's iCal feed URL before upgrading to Zammad 7.2.

Deprecated es-ca locale inactivated

The deprecated es-ca locale for Catalan will no longer be offered for selection starting with Zammad 7.2. Users still set to es-ca will be automatically migrated to the proper ca locale. Existing Knowledge Base locales referencing es-ca will not be migrated automatically due to the URL change and must be updated manually.

Stricter default Content-Security-Policy

Starting with Zammad 7.2, the default Content-Security-Policy header will include a new frame-ancestors 'self' directive.
⚠️ Setups that currently allow the Zammad web interface to be embedded in an on a different origin by overriding the X-Frame-Options header at the reverse proxy will now be blocked again by the new frame-ancestors 'self' CSP directive. To re-enable embedding from trusted origins, the frame-ancestors directive of the Content-Security-Policy response header must be adjusted at the reverse proxy as well.

Original source

Security Release

Zammad 7.0.1 & 6.5.4

April 8, 2026 · Our latest security updates address vulnerabilities in Zammad versions 7.0 and 6.5. For users who cannot yet upgrade to version 7.0, we have provided back-portable fixes for version 6.5.

Read on for full details:

In this article

• Recommended Resolution
• Zammad 7.0.1
• Zammad 6.5.4
• Infos & Advisories / Downloads

Recommended Resolution

SaaS Customers:

No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations:

We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Zammad 7.0.1

For full technical details, please refer to the security advisories on GitHub.

Vulnerabilities patched

• Information disclosure in ticket detail view of customers in shared organizations
• Incorrect access control in getting_started_controller
• Improper neutralization of script-related HTML tags in ticket articles
• Improper access control in AI assistance controller for text tools
• Server-Side Template Injection leading to RCE via AI Agent type_enrichment_data
• Missing authorization in AI assistance controller for context data used in text tools
• Server-side request forgery (SSRF) via webhooks
• Cross-site request forgery (CSRF) in OAuth callback endpoints
• Origin validation error in SSO mechanism
• Missing authorization in ticket create endpoint

Zammad 6.5.4

For full technical details, please refer to the security advisories on GitHub.

Vulnerabilities patched

• Incorrect access control in getting_started_controller
• Improper neutralization of script-related HTML tags in ticket articles
• Server-side request forgery (SSRF) via webhooks
• Cross-site request forgery (CSRF) in OAuth callback endpoints
• Origin validation error in SSO mechanism
• Missing authorization in ticket create endpoint

Original source

Zammad 6.5.3

Zammad 6.5.3 is a security release that provides all back-portable fixes for users of version 6.5 who cannot yet update to version 7.0.
Read on for all the details:

Insertion of Sensitive Information into Log File

A vulnerability was identified where Zammad recorded the REDIS_URL environment variable into log files during startup. This variable may contain credentials information.
📖 For more details, please refer to the Security Advisory ZAA-2026-02

Incorrect Access Control

Ticket customers were able to use the API to move their tickets to other groups they have no permissions for. This behavior has been corrected and is no longer possible.
📖 For more details, please refer to the Security Advisory ZAA-2026-03

Exposure of Sensitive Information to an Unauthorized Actor

Unauthorized users were able to use the API to get information about internal import status metadata. This is no longer possible.
📖 For more details, please refer to the Security Advisory ZAA-2026-04

Authorization Bypass Through User-Controlled Key

Authorized agent users were able to use the ticket_related endpoint to fetch asset data of arbitrary tickets, including customer and related user information. This is no longer the case.
📖 For more details, please refer to the Security Advisory ZAA-2026-05

SQL Injection

Due to improper SQL statement sanitization, authorized agent or customer users were able to use several API endpoints to inject custom statements to SQL queries. This could lead to the execution of unwanted operations on database level.
📖 For more details, please refer to the Security Advisory ZAA-2026-06

Original source

Long awaited, now finally here: With Zammad 7.0, the first AI features are making their way into your everyday support work. We have worked hard to develop a solution that requires no compromises: Benefit from intelligent support while retaining full control over your data and the language model used.

Zammad 7.0 makes AI a practical tool for your helpdesk — from automated ticket actions and lightning-fast summaries to hands-on support when drafting replies. And we’re staying true to our principle: we provide the features, you stay in control of the infrastructure. Which LLM is used is entirely up to you — aligned with your own security standards.

Want to see what that looks like in practice and how our beta testers rate the new features? Head over to our AI topic page.

But first — the release highlights 👇

🎥 Prefer watching to reading?
No problem! Marcel – aka That Helpdesk Guy – will guide you through what’s new in Zammad 7.0 in his latest YouTube video. Nerd talk included!

1. AI agents: Intelligent process control

Our AI agents do the groundwork in your inbox. Once configured, they can be flexibly integrated into triggers, macros, or scheduler jobs. These agents take on tasks such as automatic categorization, setting priorities, or even overwriting ticket titles for greater clarity.

• Complete transparency: Every action taken by an AI agent is documented in the ticket history, so every change remains traceable.
• Live collision notification: When an AI agent is processing a ticket, this is indicated by an avatar in the live user bar. This prevents simultaneous manual changes.

Setup and requirements:

1. AI provider: Before you activate agents, the LLM of your choice must be configured.
2. Permissions: The new permission ‘admin.ai_agent’ is required to manage agents.
3. Activation: Define your AI agents under “AI” > “AI Agents.” These do not run on their own, but must be explicitly called as an action in a trigger, macro, or scheduler job (e.g., perform action on objects: AI Agent > [your agent]).

You can find all the details on setting up the different types in our Zammad Admin documentation on AI Agents.

2. AI ticket summary: Your 'TL;DR' Section

Long ticket histories take time. With the AI summary, agents can get a precise overview of the conversation so far and the core issues of a case with just one click. This ensures immediate knowledge transfer, especially during handovers or escalations, without having to manually review pages of communication history.

What the AI summary provides you at a glance:

• Customer Intent: What does the customer want to achieve?
• Conversation Summary: What has been discussed so far?
• Open questions: What is still unclear, what information is missing?
• Upcoming Events: What appointments/tasks are pending (e.g., callback, shipping)?
• Customer Sentiment: What is the tone of the ticket (e.g., cooperative, neutral, angry)?

Setup and requirements:

• Not active by default: The feature is disabled by default. Before activation, an AI provider (LLM) must be configured. If no provider is stored, the system will display a warning message.
• Modular configuration: While the customer concern and summary are set by default after activation, you can flexibly enable or disable the other analysis modules (open questions, events, sentiment) as needed and depending on the use case.
• Resource control: As an admin, you can set whether the summary is generated automatically when the ticket is opened (maximum convenience) or only when the tab is clicked (resource-saving). This setting can be defined individually for each group.

You can find all the details on setup in our Zammad admin documentation on AI Summary.

3. AI writing assistant: Your digital editor

The AI writing assistant helps your team in the ticket editor to formulate more precise and professional responses. The AI provides suggestions, but the final decision always rests with your agents.

Standard tools (activate and use immediately):

• Convert drafts into well-written paragraphs
• Correct spelling and grammar
• Easily rephrase complex paragraphs
• Summarize long texts concisely
• Translate into other languages

Custom tools:

Create your own AI writing assistants for very specific use cases, for example, for industry-specific wording or to give texts a very specific tone (mood).

Detailed information on setup and configuration can be found in our Zammad admin documentation on AI writing assistants.

4. Bubble menu: Text formatting with a click of your cursor

Zammad 7.0 makes text editing much more convenient. Previously, formatting options were mainly accessible via keyboard shortcuts. Now, the new bubble menu provides all the important text formatting tools conveniently in the editor.

• Tools at your fingertips: Use formatting options such as bold, italics, or lists, as well as the new AI writing tools, directly on your selection.
• Auto-scroll: To help you stay focused, the menu always remains visible—even when the selection is at the edge of the screen.
• Smooth workflow: The menu eliminates the need for long mouse movements and makes keyboard shortcuts optional without interrupting your writing flow.

5. Smart details, big impact

In addition to major AI innovations, we have made many adjustments to make Zammad even more flexible and powerful.

LDAP extension: Support for nested groups

Zammad now supports nested (recursive) groups for role mapping. Admins can decide individually for each assignment whether users from subgroups should be automatically included. This enables seamless integration of existing, complex directory structures without additional manual effort.

Role-based reporting profiles

Access to reporting profiles can now be restricted to specific roles (similar to overviews). For example, team leaders can be given targeted access to relevant metrics without reporting remaining an “all-or-nothing” tool. Without an assigned role, a profile remains visible to all users with reporting permissions.

Advanced webhook functionality

Webhooks now support additional HTTP methods and the Bearer token authentication standard. This not only makes connecting third-party systems more secure, but also allows Zammad to communicate with itself via its own API. This enables complex processes to be automated, such as the automatic creation of follow-up tickets or the direct assignment of checklist templates when tickets are updated.

🚨 Important note on the update

The new ASCII folding support in the search requires that the Elasticsearch index (if used) be rebuilt after updating to Zammad 7.0. Detailed information can be found in our documentation at Rebuilding Elasticsearch Index.

⚠️ Breaking Changes

• MySQL support discontinued, database-related application settings obsolete
• Full-text search now supports Asciifolding
• nginx configuration must be updated
• Assigning the same organization as the primary and secondary organization is no longer permitted.
• Change to the Catalan language setting
• Removal of Slack integration (now via webhooks)
• Removal of Twitter/X integration

📣 Important Announcements

We are changing the behavior of the hidden setting system_bcc in the next release. System notifications will no longer be sent automatically with system_bcc. From now on, only customer communications will continue to be sent.

Original source

In this article

• Insertion of Sensitive Data into Log File
• Incorrect Access Control
• Insecure Storage of Sensitive Information
• Infos & Advisories / Downloads

Insertion of Sensitive Data into Log File

The admin interface of Zammad wrote sensitive details, such as private keys, certificates, and passphrases, to the Rails log file.

🏠 Self-hosted users: We strongly recommend updating immediately. Additionally, please review your existing logs — and any connected systems that process them — to identify and clean up potentially exposed data.

☁️ SaaS users: No action is required. We’ve already taken the necessary steps on our end.

📖 For more details, please refer to the Security Advisory ZAA-2025-07.

Incorrect Access Control

Logging subsystem (HttpLog) API access control is now more fine grained. In the past, any admin.* permission was sufficient to access this data. Now, only the relevant parts can be accessed (e.g. admin.webhook).

🏠 For self hosted installations, we strongly advise admins to update their system to Zammad 6.5.2.

☁️ For our SaaS customers, there’s nothing you need to worry about: we’ve already taken care of everything for you.

📖 For more details, please refer to the Security Advisory ZAA-2025-08.

Insecure Storage of Sensitive Information

Logging subsystem (HttpLog) would store complete requests in the database, including sensitive information like tokens, secrets, etc. This was prevented and existing HttpLog records were cleaned up.

🏠 Self-hosted installations: Please update your system to apply the fix and prevent further exposure.

☁️ SaaS users: You’re already protected — no further action needed.

📖 For more details, please refer to the Security Advisory ZAA-2025-09.

Original source

Security Release

Zammad 6.5.1

August 13, 2025 · Important security updates are included in this release. All self-hosted instances must be updated immediately.

Please read on for details:

In this article

• Incorrect Access Control in Knowledge Base
• HTML Injection
• Technical Requirements
• Advisories
• Download Zammad 6.5.1

Incorrect Access Control in Knowledge Base

A permission issue was identified where agents could see titles of Knowledge Base articles they didn’t have permission to access when using the global search. While the article content remained protected, these entries should not have been visible at all. This has now been corrected.

📖 For more details, please refer to the Security Advisory ZAA-2025-05.

HTML Injection

Various sections of the Zammad front end failed to perform the correct HTML escape function when outputting data. This could have allowed HTML injection in the browser. However, execution of JavaScript code was correctly prevented by Content Security Policy.

📖 For more details, please refer to the Security Advisory ZAA-2025-06.

🎥 Prefer video over text?

No problem! In his latest YouTube video, Marcel – aka That Helpdesk Guy – takes you on a quick, clear, and slightly nerdy tour of the latest security release.

👉 Watch the video

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisories

ZAA-2025-05

ZAA-2025-06

Download Zammad 6.5.1

All improvements can be found in the Changelog.

Packages

• Ubuntu / Debian
• OpenSUSE / SLES
• CentOS / RHEL
• Docker-Compose

Source code

• ftp.zammad.com/zammad-6.5.1.tar.bz2 (fe9b2e645f8ecb8bb1b090d8aa61a846)
• ftp.zammad.com/zammad-6.5.1.tar.gz (9e2789a9f54f06166332cf78d4011b64)
• ftp.zammad.com/zammad-6.5.1.zip (33da8a7755fff7e6787b88cf109d489a)

Upgrade

Here you can find information on upgrading your Zammad installation:

• With Package
• From source
• With Docker

Original source