CVE-2026-56731
Received Received - Intake

Stored XSS in Zammad Helpdesk System

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization. This issue is fixed in version 7.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56731
EUVD
EUVD-2026-87216

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad 7.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad is a web-based open source helpdesk system. A vulnerability exists in versions prior to 7.0.1 where a low-privilege authenticated user can inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title during standard ticket creation. The title is stored without proper sanitization, allowing potential malicious code execution.

Detection Guidance

Check Zammad version with: zammad version. If version is below 7.0.1, the system is vulnerable. Inspect ticket titles for unusual HTML or JavaScript content, especially in titles created by low-privilege users.

Impact Analysis

An attacker with low privileges could exploit this to inject malicious scripts into ticket titles. When viewed by other users, these scripts could execute in their browsers, potentially leading to data theft, session hijacking, or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance with privacy regulations, and potential legal penalties due to inadequate protection of personal or health information.

Mitigation Strategies

Upgrade Zammad to version 7.0.1 or later immediately. If immediate upgrade is not possible, restrict low-privilege user permissions to prevent ticket title modifications until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56731. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart