An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Zammad | Zammad | 6.1.0 (including) | 6.1.0 (including) |
| Zammad | Zammad | 6.1.0-alpha (including) | 6.1.0-alpha (including) |
| Zammad | Zammad | 6.2.0-alpha (including) | 6.2.0-alpha (including) |