CVE-2026-63216 in Zammad
Summary
by MITRE • 09/25/2026
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An attacker who can control an option label, for example by setting a malicious string as a user or organization name used in a relation attribute, or by supplying a crafted custom attribute option value, can inject arbitrary HTML and JavaScript. The payload executes in the browser of any admin or agent who opens the affected object attribute configuration view. This issue is fixed in version 7.1.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
Zammad serves as a prominent open-source helpdesk and customer support platform, facilitating communication between businesses and their customers through various channels including email, chat, phone, and social media. The software provides an administrative interface where system administrators and agents can configure AI agents, manage user roles, define custom attributes, and adjust organizational settings. Within this admin UI, the configuration dialogs for AI Agents allow users to select from predefined options or create new ones via relation attributes such as user names, organization identifiers, or custom attribute values. These selections are then rendered in the interface to display which options have been chosen by a specific agent profile.
A critical security flaw exists in versions of Zammad prior to 7.1.2 regarding how these selected option labels are processed and displayed within the browser environment. The vulnerability stems from insufficient input validation and output encoding mechanisms when rendering the list of selected options for AI Agent configurations. Specifically, the application takes user-controlled data—such as a maliciously crafted string embedded in a user name, organization name, or custom attribute value—and injects it directly into the HTML structure without applying proper escaping or sanitization techniques. This lack of context-aware encoding allows special characters and script tags to be interpreted by the browser's rendering engine rather than being treated as plain text data.
The operational impact of this flaw is significant because it enables a Stored Cross-Site Scripting attack vector within an administrative context. An attacker who possesses the ability to control specific input fields, such as creating a user account with a malicious name or modifying organization details, can embed arbitrary HTML and JavaScript payloads into these attributes. When another administrator or agent subsequently opens the configuration view for an AI Agent that references this tainted data, the browser executes the injected script in the context of the Zammad application. This execution occurs within the privileged session of the admin user, potentially allowing the attacker to hijack administrative sessions, steal sensitive cookies or authentication tokens, perform actions on behalf of the victim administrator, or exfiltrate confidential customer support data stored within the platform.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific mechanism involves reflected or stored script injection depending on whether the payload is executed immediately upon input submission or persists in the database and triggers later during rendering. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1059, specifically sub-techniques related to command and scripting interpreter execution within a web browser context. The attack chain relies on social engineering or prior compromise of low-level accounts to inject the payload, followed by privilege escalation through session hijacking once an admin interacts with the compromised configuration view.
Mitigation for this vulnerability requires immediate upgrading to Zammad version 7.1.2 or later, where the developers have implemented proper output encoding and input sanitization routines in the rendering logic of AI Agent configurations. For organizations unable to upgrade immediately due to operational constraints, temporary mitigations include restricting access to the admin UI through strict network segmentation and multi-factor authentication to reduce the risk of unauthorized users gaining the necessary permissions to inject payloads. Additionally, implementing a Content Security Policy (CSP) that restricts script execution from untrusted sources can help mitigate the impact by preventing the injection of arbitrary JavaScript even if the XSS vector is successfully triggered. Regular security audits and code reviews focusing on data binding practices in web frameworks are also recommended to prevent similar input validation failures in other parts of the application.