Zammad CVE-2026-56731

Requires an authenticated account on the Zammad instance with permission to create tickets (a standard low-privilege agent/customer using the normal ticket-creation workflow - PR:L). Exploitation is NOT self-contained: a victim with a session (typically a support agent or admin) must subsequently render the malicious ticket title, either by viewing the ticket in the UI or by receiving/opening a notification/escalation/reminder email that interpolates the title (UI:A). No special non-default configuration is needed - the standard ticket workflow and notification templates are the affected code paths. Limiting factors: authentication is required, victim interaction is required, and the severity of impact depends on the privilege level of the user who views the payload. Affects Zammad prior to 7.0.1.

This is a moderate-priority stored XSS (CWE-79) in Zammad, not a top-tier emergency despite the vendor CVSS 4.0 base of 8.4. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L indicates network-reachable, low-complexity, but authenticated (PR:L) exploitation that REQUIRES victim interaction (UI:A) - a privileged user (agent/admin) must view the malicious ticket for the payload to fire. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is a targeted, opportunistic risk rather than a mass-exploited flaw. The VC:H and VI:H (high confidentiality AND integrity impact) in the vendor vector appear somewhat overstated for a stored XSS: real impact scales with the privilege of the victim who renders the title (session/token theft or admin action-forgery is plausible if an admin views the payload, but the base case is same-origin script execution in a helpdesk agent's browser). No conflicting signals on the vector itself, but note the impact metrics are optimistic-worst-case. Overall: a genuine, easy-to-inject stored XSS gated by authentication and victim view, warranting prompt patching to 7.0.1 but not the drop-everything urgency an 8.4 alone implies.

A low-privilege authenticated Zammad user creates a ticket whose title contains HTML with a JavaScript event handler (e.g. an <img>/<svg> onerror payload). The title is persisted without sanitization and later interpolated into notification/mailer templates and the ticket UI; when a support agent or admin opens the ticket or receives the notification, the script executes in their authenticated same-origin session, enabling session/token theft or actions performed as the victim. No public exploit code is identified, but the payload is trivial to craft.