CVE-2026-56732
Received Received - Intake

Session Hijack via HTML Sanitization Flaw in Zammad

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56732
EUVD
EUVD-2026-87219

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad to 7.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad is a web-based open source helpdesk system. A vulnerability exists in versions prior to 7.0.2 where HTML sanitization fails to block specific elements in ticket bodies. Attackers can inject malicious HTML that forces a logged-in user's session to log out when viewed.

Detection Guidance

Detecting this vulnerability requires checking the installed version of Zammad. Run: zammad version. If the version is below 7.0.2, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to disrupt user sessions by forcing logouts. Users viewing crafted tickets may lose access to their active sessions, requiring re-authentication. It does not directly expose data but can disrupt workflows and cause inconvenience.

Compliance Impact

The vulnerability allows session hijacking via crafted HTML elements in ticket bodies, which could lead to unauthorized access to user sessions. This may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., unauthorized access to protected health information) if exploited.

Mitigation Strategies

Upgrade Zammad to version 7.0.2 or later immediately. This fixes the HTML sanitization issue that allows session logout via crafted tickets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56732. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart