SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

📣 Important Announcements

Knowledge Base search index: new publication_state field

Zammad 7.2 will introduce a new publication_state field for KnowledgeBase::Answer::Translation as part of the new Suggested searches functionality in the Knowledge Base search. The field reflects an answer’s current state (draft, internal, published, or archived).

To make the new field available after upgrading to Zammad 7.2, the search index must be rebuilt:

zammad run rake zammad:searchindex:rebuild

Without rebuilding the index, queries such as publication_state:draft will return no results.

Calendar iCal feed must be a URL

Starting with Zammad 7.2, the functionality of using local file paths for calendars iCal feed source will be removed.

Deprecated es-ca locale inactivated

The deprecated es-ca locale for Catalan will no longer be offered for selection starting with Zammad 7.2. Users still set to es-ca will be automatically migrated to the proper ca locale. Existing Knowledge Base locales referencing es-ca will not be migrated automatically due to the URL change and must be updated manually.

Stricter default Content-Security-Policy

Starting with Zammad 7.2, the default Content-Security-Policy header will include a new frame-ancestors 'self' directive.

⚠️ Setups that currently allow the Zammad web interface to be embedded in an <iframe> on a different origin by overriding the X-Frame-Options header at the reverse proxy will now be blocked again by the new frame-ancestors 'self' CSP directive. To re-enable embedding from trusted origins, the frame-ancestors directive of the Content-Security-Policy response header must be adjusted at the reverse proxy as well.