Znuny Password Exposure Vulnerability - CVE-2025-26847
Summary
CVE-2025-26847: An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked. Affects znuny versions 6.3.2-3 – 6.5.9-1~bpo12+1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Znuny is an open-source ticketing system that provides a platform for managing customer support and service requests. It is designed to streamline communication between users and support teams, offering features such as ticket tracking, reporting, and automation. The vulnerability in question arises during the generation of support bundles, where sensitive information, specifically passwords, may not be adequately masked, posing a risk to user security.
Vulnerability Detail
CVE-2025-26847 is a security vulnerability found in Znuny versions prior to 7.1.5. The issue occurs when the application generates support bundles, which are intended to assist in troubleshooting and support processes. During this process, not all passwords are masked, potentially exposing sensitive user credentials. This vulnerability can lead to unauthorized access and data breaches if the support bundles fall into the wrong hands.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually review support bundles before sharing them to ensure that no sensitive information is included. Additionally, consider limiting access to support bundles to trusted personnel only.
Conclusion
CVE-2025-26847 presents a significant security risk for users of Znuny prior to version 7.1.5 due to the inadequate masking of passwords in support bundles. It is crucial for users to update their installations to the latest version to mitigate this risk and ensure the security of their sensitive information.
See every vulnerability recorded for znuny →
FAQ
CVE-2025-26847 is a vulnerability in Znuny that allows passwords to be exposed in support bundles.
If you are using a version of Znuny prior to 7.1.5, your installation is affected by this vulnerability.
The primary risk is the potential exposure of user passwords, which could lead to unauthorized access to accounts and sensitive data.
Yes, upgrading to Znuny version 7.1.5 or later addresses this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application for vulnerabilities at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for znuny.
