Zammad CVE-2026-63204

Requires an authenticated account with agent permissions on the target Zammad instance (PR:L) and access to the ticket summarize endpoint. The attacker must supply a valid ai_analytics_run_error_id (AT:P) that references a run which recorded a provider error - meaning the AI analytics/summarize feature must be in use and an errored run must exist. Disclosure is strictly limited to the provider error string; ticket content is never exposed. Affects all Zammad versions prior to 7.1.2. No user interaction and no non-default configuration beyond the AI summarize feature being present.

All signals point to a genuinely low-priority issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L, base 2.3) is consistent with the description: an authenticated agent-level user leaks only a stored AI provider error string, with no integrity or availability impact and confidentiality rated Low. The AT:P (attack requirement present) reflects that the attacker must know or guess a valid ai_analytics_run identifier for a run that actually recorded an error. No EPSS score, no CISA KEV listing, and no public POC are present in the input - no public exploit identified at time of analysis. The single 'reference' beyond the disclosure is the fix commit itself (adds authorize!(ai_analytics_run_error, :show?)), which confirms the root cause but does not weaponize it. There is no conflict between the description and the CVSS vector; both agree this is an authenticated, low-impact information disclosure. The one metadata problem is the 'Authentication Bypass' tag, which is inaccurate - this is a per-record authorization (IDOR) flaw, not an authentication bypass. Bottom line: real but minor, appropriately scored low, not an urgent patch priority beyond routine Zammad updates.

An authenticated Zammad agent calls the ticket summarize endpoint and supplies an ai_analytics_run_error_id belonging to a run linked to a ticket outside their permission scope. The endpoint returns the stored AI provider error_message for that run despite the agent lacking access to the underlying ticket. No public POC exists; the fix commit's spec illustrates the exact request but is a regression test, not weaponized exploit code.