🚨 Important note on the update

nginx/Apache2 Configuration Update Required

If you use nginx or Apache2, you need to update your configuration to include the Remote-User header alongside the existing X-Forwarded-User header.

Add the following line to your configuration file:

nginx:

# change this line in an SSO setup
proxy_set_header X-Forwarded-User "";
proxy_set_header Remote-User "";

Apache2:

# change this line in an SSO setup
RequestHeader unset X-Forwarded-User
RequestHeader unset Remote-User

Important for SSO setups: Ensure your reverse proxy sets exactly one of these two headers (X-Forwarded-User or Remote-User) and clears the other.

Docker users: No action is required. This configuration change is applied automatically in the Docker images.

SaaS Customers: No action is required. Your instances have already been updated to Zammad 7.2.3.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.