Security Patch Level Release 
After upgrading to Zammad 5.0, some customers noticed a bug in the notification handling:
Zammad offers the option to define another user as a replacement during times of absence. The selected user will then receive the absent user’s notifications and tickets. 
Some users reported that the replacements saw notifications from groups that they are not part of. Although they didn’t have access to the corresponding tickets, the notifications alone could give away sensitive information that is not intended for them.
We take this issue seriously, which is why we have created a new security release at short notice, instead of waiting for the release of Zammad 5.1. You can find out more in the release notes.
(Earlier versions, prior to Zammad 5.0, are not affected by this vulnerability.)