Zammad CVE-2026-63206

No authentication or special configuration is required to deliver the payload - any external party can send an email or open a ticket, since the sanitizer runs on all ticket/email article HTML in Zammad < 7.1.2 by default. Exploitation is LIMITED by required user interaction (UI:P): a recipient - typically an agent viewing the ticket article or email view in the browser - must open the crafted content for the pixel to load. The payload must use the slash-less scheme form (e.g. src or srcset = 'http:attacker.example/pixel.gif') to evade the pre-7.1.2 unsafe_link_protocol? check; standard 'http://' URLs are already blocked. Impact is bounded to disclosing read-receipt metadata (open time, recipient IP/User-Agent), not article contents or credentials.

This is a genuine but low-severity information-disclosure flaw, not a high-impact issue. The NVD CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:N/UI:P/VC:L, all other impacts N) is internally consistent with the description: an unauthenticated remote attacker sends a crafted email/ticket, and disclosure is limited (VC:L) to metadata - when and by whom the ticket was opened - via a silently-loaded remote tracking pixel. There is no integrity or availability impact, and no code execution. No EPSS score, KEV listing, or public POC was provided, so this is not confirmed to be exploited; the fix commit (a5878f37) publicly discloses the exact bypass payload (http:host without slashes), which lowers the bar to reproduce but is not the same as active exploitation. Overall this is a realistic bug-bounty-class privacy/tracking-pixel bypass rather than an urgent patch priority: real risk is bounded by the requirement that a recipient (typically an agent) open the malicious content, and the only reward to the attacker is read-receipt-style metadata. The 'Authentication Bypass' tag conflicts with the actual mechanism - nothing about authentication is bypassed; the sanitizer's remote-content blocker is bypassed to leak metadata.

An attacker emails the helpdesk (or opens a ticket) containing an <img> whose src or srcset uses the slash-less form 'http:attacker.example/pixel.gif'. Zammad's sanitizer fails to recognize this as a remote URL, so it strips no content and shows no 'remote content blocked' warning; when an agent opens the ticket, their browser silently fetches the pixel, revealing to the attacker the agent's IP/User-Agent and exactly when the ticket was read. No public exploit code was identified, but the fixing commit discloses the exact payload format.