CVE-2026-63216

Received Received - Intake

XSS in Zammad Admin UI AI Agent Configuration

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An attacker who can control an option label, for example by setting a malicious string as a user or organization name used in a relation attribute, or by supplying a crafted custom attribute option value, can inject arbitrary HTML and JavaScript. The payload executes in the browser of any admin or agent who opens the affected object attribute configuration view. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-63216

EUVD

EUVD-2026-87262

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

Zammad is a helpdesk system vulnerable to cross-site scripting (XSS) due to unsanitized option labels in AI Agents configuration. Attackers can inject malicious HTML or JavaScript by controlling option labels, such as via user/organization names or custom attributes. This executes in the browser of admins or agents viewing the affected configuration.

Detection Guidance

Check Zammad version with: zammad version. If version is below 7.1.2, the system is vulnerable. Inspect admin UI for AI Agents configuration dialogs where unsanitized option labels may render raw HTML or JavaScript.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or deface the admin interface. Admins and agents viewing the affected configuration are at risk of arbitrary code execution in their browsers.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity/confidentiality principles or HIPAA's security rules. Organizations may face compliance breaches if user data is compromised through this attack vector.

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later immediately. Review and sanitize all user, organization, and custom attribute option labels to prevent malicious input. Restrict admin and agent access to configuration interfaces until patched.

Hi! I’m here to help you understand CVE-2026-63216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70