An issue exists in Zammad prior to 3.4.1. Admin Users without a ticket.* permission can access Tickets.
zammad zammad