CVE-2026-63204

Received Received - Intake

Authenticated User Access to AI Provider Error Messages in Zammad

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run belongs to a ticket the agent is not authorized to access. The disclosure is limited to the provider error string; ticket content is not exposed. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-63204

EUVD

EUVD-2026-87269

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Zammad allows an authenticated agent user to access an AI analytics error message for a ticket they are not authorized to view by supplying an arbitrary run identifier to the ticket summarize endpoint. The issue is fixed in version 7.1.2.

Detection Guidance

This vulnerability can be detected by checking the Zammad version installed on your system. If the version is below 7.1.2, the system is vulnerable. Run the command: zammad version to check the installed version. Additionally, review logs for unauthorized access attempts to the ticket summarize endpoint.

Impact Analysis

The impact is limited to exposure of AI provider error strings for unauthorized tickets. It does not expose ticket content, reducing the risk of sensitive data leakage.

Compliance Impact

The vulnerability allows limited disclosure of AI provider error messages to unauthorized agents but does not expose ticket content. This may pose minor compliance risks under GDPR or HIPAA if error messages inadvertently contain sensitive metadata, though no direct evidence of such exposure is provided.

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later to address the vulnerability. Ensure only authorized agents have access to the ticket summarize endpoint and review AI analytics run identifiers for suspicious activity.

Hi! I’m here to help you understand CVE-2026-63204. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70