Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1022

NIXPKGS-2026-1022

GitHub issue published on

Permalink CVE-2026-34720

updated 5 hours ago by @LeSuisse Activity log

Created automatic suggestion 10 hours ago
@LeSuisse removed package python312Packages.zammad-py 5 hours ago
@LeSuisse removed package python313Packages.zammad-py 5 hours ago
@LeSuisse removed package python314Packages.zammad-py 5 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

Zammad has an origin validation error in SSO mechanism

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.

References

https://github.com/zammad/zammad/security/advisories/GHSA-hcv6-w4h9-p2p7 x_refsource_CONFIRM

Affected products

zammad

==< 6.5.4
==>= 7.0.0-alpha, < 7.0.1

Matching in nixpkgs

pkgs.zammad

Zammad, a web-based, open source user support/ticketing solution

nixos-unstable 7.0.0
- nixpkgs-unstable 7.0.0
- nixos-unstable-small 7.0.0
nixos-25.11 6.5.2
- nixos-25.11-small 7.0.0
- nixpkgs-25.11-darwin 7.0.0

Ignored packages (3)

pkgs.python312Packages.zammad-py

Python API client for accessing zammad REST API

nixos-25.11 3.2.0
- nixos-25.11-small 3.2.0
- nixpkgs-25.11-darwin 3.2.0

pkgs.python313Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1
nixos-25.11 3.2.0
- nixos-25.11-small 3.2.0
- nixpkgs-25.11-darwin 3.2.0

pkgs.python314Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1

Package maintainers

@NetaliDev Jennifer Graul <me@netali.de>
@Radvendii Taeer Bar-Yam <taeer@necsi.edu>