Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1029

NIXPKGS-2026-1029

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34721

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
3 packages
- python312Packages.zammad-py
- python313Packages.zammad-py
- python314Packages.zammad-py
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 and 6.5.4.

References

https://github.com/zammad/zammad/security/advisories/GHSA-mfwp-hx66-626c x_refsource_CONFIRM

Affected products

zammad

==>= 7.0.0-alpha, < 7.0.1
==< 6.5.4

Matching in nixpkgs

pkgs.zammad

Web-based, open source user support/ticketing solution

nixos-unstable 7.0.0
- nixpkgs-unstable 7.0.0
- nixos-unstable-small 7.0.0

Ignored packages (3)

pkgs.python312Packages.zammad-py

None

pkgs.python313Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1

pkgs.python314Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1

Package maintainers

@meenzen Samuel Meenzen <samuel@meenzen.net>
@Radvendii Taeer Bar-Yam <taeer@necsi.edu>
@NetaliDev Jennifer Graul <me@netali.de>