has published a demonstration of an issue affecting Zammad 6.3.0–6.5.4, a customer-support application.
Under specific conditions, a visitor without an account can obtain information that may include a temporary key belonging to a signed-in user; an active live connection is required.
If the key belongs to an administrator, commands may run with the permissions of the Zammad application account—not full system administrator…