CVE-2026-102345 in Zammad
Summary
by MITRE • 11/04/2026
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
Zammad serves as a prominent open-source helpdesk and customer support platform designed to manage communication channels such as email, chat, phone, social media, and tickets within a unified system. The software relies on modern web technologies to provide an intuitive interface for both agents and customers interacting with the organization's support infrastructure. In versions prior to 7.1.2, the application utilized a new Vue-based ticket interface that introduced specific rendering behaviors regarding how content is processed and displayed to end users. This architectural shift aimed to improve performance and user experience but inadvertently created a security gap in the handling of untrusted input within article bodies.
The core technical flaw lies in the insufficient output encoding applied when rendering ticket article content within this Vue-based interface. When an authenticated user creates or edits a ticket, they can insert arbitrary markup into the body of that ticket's articles. The application fails to properly sanitize or encode these inputs before displaying them to other users who view the same ticket. Consequently, if the stored data contains executable script tags or event handlers, the browser will interpret and execute this code in the context of the victim user’s session. This mechanism constitutes a classic Stored Cross-Site Scripting vulnerability, where malicious payloads are persistently stored on the server and delivered to victims upon request rather than being reflected directly from the URL parameters as seen in Reflected XSS attacks.
The operational impact of this vulnerability is significant because it allows an authenticated attacker to execute arbitrary JavaScript code within the browser context of any other user who views the compromised ticket. This can lead to session hijacking, where attackers steal authentication cookies or tokens to impersonate legitimate users and gain unauthorized access to sensitive support data. It also enables keylogging, credential harvesting on integrated third-party services accessed through single sign-on mechanisms, and defacement of the interface. Since Zammad handles potentially confidential customer information, such as personal identifiable information (PII) or proprietary business details, a successful exploitation could result in severe data breaches and regulatory compliance violations under frameworks like GDPR or HIPAA depending on the industry sector.
Despite these risks, the practical impact is somewhat mitigated by the default Content Security Policy implemented within Zammad. This policy restricts the execution of inline scripts and limits the sources from which resources can be loaded, thereby raising the bar for successful exploitation. Attackers would need to bypass or exploit weaknesses in this CSP configuration to achieve full code execution capabilities. Furthermore, it is important to note that this vulnerability specifically affects the new Vue-based interface; the classic REST API combined with CoffeeScript rendering engine remains unaffected by this specific flaw, providing a fallback mechanism for organizations requiring more stable legacy interfaces during updates.
To remediate this issue, administrators must upgrade Zammad to version 7.1.2 or later, where the output encoding logic has been corrected to ensure that all user-supplied content is properly escaped before being rendered in the DOM. This prevents the browser from interpreting malicious markup as executable code. In addition to patching, organizations should enforce strict Content Security Policy configurations and consider implementing additional input validation layers at the application level. Regular security audits and penetration testing of web interfaces are recommended to identify similar encoding flaws across other modules of the helpdesk system.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the sub-category of Stored XSS where malicious scripts are permanently stored within target databases or content management systems. In terms of adversary tactics and techniques, this flaw maps to MITRE ATT&CK technique T1059: Command and Scripting Interpreter, particularly JavaScript execution in browser contexts. It also relates to T1189: Drive-by Client Side Web Traffic if the attack vector involves tricking users into visiting specific URLs or viewing compromised tickets as part of a broader phishing campaign aimed at compromising support staff accounts.