CVE-2026-77506 in Znuny
Summary
by MITRE • 08/21/2026
Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Znuny prior to version LTS 6.5.22 represents a significant security flaw within the application's ticketing system, specifically affecting the AgentTicketEmailResend functionality. This component is designed to allow support agents to resend existing customer emails associated with specific tickets, ensuring that communication history remains accessible and actionable for service desk operations. The core technical issue stems from improper input validation and insufficient output encoding when rendering templates within this module. When an agent interacts with the system to trigger a resend operation or view related template data, the application fails to properly sanitize user-supplied input before including it in the HTML context of the generated email preview or notification interface. This oversight allows for the injection of malicious scripts that execute in the browser sessions of authorized users who access these templates.
From a technical perspective, this is classified as a Cross-Site Scripting (XSS) vulnerability, specifically falling under CWE-79: Improper Neutralization of Input During Web Page Generation. The flaw resides in how the AgentTicketEmailResend template processes variables that may contain untrusted data. If an attacker can influence the content of these templates or manipulate parameters passed to this function through crafted requests, they can inject JavaScript code. Because Znuny is a web-based application requiring authentication for agent access, this vulnerability typically manifests as stored or reflected XSS depending on how the malicious payload is introduced and subsequently rendered in the user interface. The lack of robust encoding mechanisms means that special characters such as angle brackets, quotes, and ampersands are not escaped correctly, allowing script tags to be interpreted by the victim's browser rather than displayed as plain text.
The operational impact of this vulnerability extends beyond simple defacement or session hijacking in isolation. Since Znuny is often used for critical customer support operations involving sensitive personal data and proprietary information, a successful exploitation could lead to severe consequences. An attacker with access to exploit this flaw could steal administrative cookies or session tokens, thereby gaining unauthorized control over agent accounts. This level of compromise allows the adversary to impersonate legitimate staff members, potentially accessing confidential ticket details, modifying customer records, or exfiltrating data from the system. Furthermore, if the application is integrated with other enterprise systems via APIs or webhooks triggered by these interactions, the attack surface expands significantly, enabling lateral movement within the organization's network infrastructure.
This vulnerability aligns closely with MITRE ATT&CK technique T1059.007: JavaScript, which describes how attackers use browser-based scripting languages to execute malicious actions on a victim's machine without downloading additional files. It also relates to TA0005: Defense Evasion and TA0006: Credential Access in the broader attack lifecycle context. The ability to inject scripts into an authenticated session effectively bypasses many traditional perimeter defenses because the traffic appears as legitimate user activity from within the trusted network zone or application environment. This makes detection challenging for standard intrusion prevention systems that do not perform deep content inspection of dynamic web pages.
To mitigate this risk, organizations running Znuny versions earlier than LTS 6.5.22 must prioritize immediate patching to upgrade to a version where this template handling has been secured with proper output encoding and input validation routines. Until the update is applied, administrators should implement strict access controls limiting who can interact with email resend functions and consider deploying web application firewalls configured to detect and block common XSS payloads in HTTP requests targeting these endpoints. Additionally, enabling Content Security Policy headers on the Znuny deployment can help mitigate the impact of any successful injection by restricting the sources from which scripts are allowed to execute. Regular security audits focusing on template rendering logic across all modules are recommended to ensure no similar vulnerabilities exist elsewhere in the application codebase.