CVE-2025-26842

EUVD-2025-14011
An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 51%
Affected Products (NVD)
VendorProductVersion
znunyznuny
𝑥
≤ 7.1.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
znuny
bookworm
no-dsa
bookworm/non-free
vulnerable
forky/non-free
6.5.18-1
fixed
sid/non-free
6.5.18-1
fixed
trixie/non-free
6.5.15-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
znuny
focal
dne
jammy
dne
noble
needs-triage
oracular
ignored
plucky
not-affected
questing
not-affected
Common Weakness Enumeration
References
https://www.znuny.org/en/advisories/zsa-2025-01