ZSA-2026-13

Date: 2026-09-16
Affected: All versions of Znuny LTS from 6.5.1 up to including 6.5.24.
All versions of Znuny from 7.3.1 up to including 7.3.6.
All versions of Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, and 7.2.
Severity: high
CVE: CVE-2026-48188

A SQL injection vulnerability exists in the agent login (Kernel::System::Auth::DB). The submitted username was inserted into the login SQL query after being escaped with the database's Quote() method instead of being passed as a bound parameter, which could allow an attacker to manipulate the query used to authenticate agent logins.

Fixed in: Znuny LTS 6.5.25 and Znuny 7.3.7