ZSA-2026-16

Date: 2026-10-14
Affected: All versions of Znuny LTS from 6.5.1 up to including 6.5.25.
All versions of Znuny from 7.3.1 up to including 7.3.7.
All versions of Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, and 7.2.
Severity: medium
CVE: Requested

Form IDs used to track in-progress attachment uploads (Kernel::System::Web::UploadCache::DB and Kernel::System::Web::UploadCache::FS) were generated with the non-cryptographic rand() function and were not tied to the user or session that created them. A logged-in attacker who guessed or observed another user's form ID could view or replace that user's uploaded attachments while a ticket or article reply was still being composed.

Fixed in: Znuny LTS 6.5.26 and Znuny 7.3.8

Thanks to @kta1kri for reporting.