Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1029

NIXPKGS-2026-1029

GitHub issue published on

Permalink CVE-2026-34721

updated 3 hours ago by @LeSuisse Activity log

Created automatic suggestion 8 hours ago
@LeSuisse removed package python312Packages.zammad-py 4 hours ago
@LeSuisse removed package python313Packages.zammad-py 4 hours ago
@LeSuisse removed package python314Packages.zammad-py 4 hours ago
@LeSuisse accepted 4 hours ago
@LeSuisse published on GitHub 3 hours ago

Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 and 6.5.4.

References

https://github.com/zammad/zammad/security/advisories/GHSA-mfwp-hx66-626c x_refsource_CONFIRM

Affected products

zammad

==< 6.5.4
==>= 7.0.0-alpha, < 7.0.1

Matching in nixpkgs

pkgs.zammad

Zammad, a web-based, open source user support/ticketing solution

nixos-unstable 7.0.0
- nixpkgs-unstable 7.0.0
- nixos-unstable-small 7.0.0
nixos-25.11 6.5.2
- nixos-25.11-small 7.0.0
- nixpkgs-25.11-darwin 7.0.0

Ignored packages (3)

pkgs.python312Packages.zammad-py

Python API client for accessing zammad REST API

nixos-25.11 3.2.0
- nixos-25.11-small 3.2.0
- nixpkgs-25.11-darwin 3.2.0

pkgs.python313Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1
nixos-25.11 3.2.0
- nixos-25.11-small 3.2.0
- nixpkgs-25.11-darwin 3.2.0

pkgs.python314Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1

Package maintainers

@NetaliDev Jennifer Graul <me@netali.de>
@Radvendii Taeer Bar-Yam <taeer@necsi.edu>