CVE-2026-84463

Received Received - Intake

Stored XSS in Zammad Knowledge Base Widget

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML without being escaped for its attribute context, allowing it to break out and inject additional HTML into the page. When another user who has permission to switch between user sessions views the affected answer, the injected HTML causes their browser to silently send a request to Zammad's session-switching endpoint using their own active credentials. This results in switching their session to an account chosen by the person who wrote the Knowledge Base answer. No action is required from the viewer beyond opening the published answer. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-84463

EUVD

EUVD-2026-87264

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-838	The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.

Attack-Flow Graph

Executive Summary

Zammad is a web-based open source helpdesk system. A vulnerability exists in versions prior to 7.1.2 where a user with Knowledge Base editing rights can inject malicious HTML into a published answer by embedding a video widget with a specially crafted value. This injected HTML is not properly escaped, allowing it to break out and add extra HTML to the page.

Detection Guidance

To detect this vulnerability, check if your Zammad instance is running a version prior to 7.1.2. Use the command: zammad version or check the web interface for version information. Inspect Knowledge Base articles for embedded video widgets with unusual or crafted HTML attributes.

Impact Analysis

The vulnerability allows an attacker to silently switch another user's active session to an account of the attacker's choice when the victim views the affected Knowledge Base answer. This happens without requiring any action from the victim beyond opening the answer. It could lead to unauthorized access to the victim's account and sensitive data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized session switching. If an attacker exploits this flaw, they could gain access to a user's account without their consent, which may violate data protection requirements such as GDPR's principles of lawfulness and transparency or HIPAA's access controls. The unauthorized session switch could lead to unauthorized access to sensitive data, posing risks to confidentiality and integrity.

Mitigation Strategies

Immediately upgrade Zammad to version 7.1.2 or later. Review and remove any suspicious Knowledge Base articles containing embedded video widgets with crafted HTML. Restrict Knowledge Base editing rights to trusted users only.

Hi! I’m here to help you understand CVE-2026-84463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70