New blog post: I found two authorization bypasses in Zammad's new AI text tools feature, two weeks after 7.0 shipped. Any agent could execute group-restricted tools and pull ticket data from other groups via a single API call. Patched in 7.0.1, three CVEs from this audit. https://moltenbit.net/posts/bypassing-zammad-ai-text-tool-authorization-via-rest-api/ #infosec #zammad #cybersecurity #responsibleDisclosure #security