Zammad CVE-2026-63216

Requires an authenticated attacker able to control a rendered option label - e.g. setting a malicious user or organization name used as a relation-attribute label, or supplying a crafted custom attribute option value (PR:L). Execution is gated on a privileged admin or agent subsequently opening the affected object-attribute / AI Agent options configuration view in the Zammad admin UI, so a victim interaction is effectively required despite the vector's UI:N. Limited to Zammad instances prior to 7.1.2; no exploitation against default configuration without an attacker-influenced label and a victim viewing the config dialog.

This is a stored/DOM cross-site scripting flaw (CWE-80) in Zammad's admin UI, specifically the object_attribute_options_context element used in AI Agent and object-attribute configuration dialogs, where option labels are emitted as raw HTML (<%- option.label %>) instead of escaped. The vendor CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) is a reasonable MEDIUM rating, though UI:N is questionable: the payload only executes when a privileged admin or agent actually opens the affected attribute-configuration view, which is genuine user interaction (UI:R/UI:A) - I would model that limiting factor explicitly. All exploitation signals point to low real-world urgency: no EPSS score is provided, the CVE is not on the CISA KEV list, and no public exploit code is referenced. SSVC framework inputs (exploitation status, automatable) are not supplied. The commit diff and an added QUnit regression test confirm the root cause and fix, so the vulnerability is real and verified, but it is a privilege-gated, interaction-dependent stored XSS in a niche self-hosted helpdesk - a routine patch-in-normal-cycle item, not an emergency. No conflicting signals; the main caveat is the UI:N vs UI:R discrepancy.

A low-privileged authenticated user (or an attacker who can influence a user/organization name or a custom attribute option value) sets a name/label containing an HTML/JavaScript payload such as <img src=x onerror=...>. Later, an admin or agent opens the object-attribute or AI Agent configuration dialog that lists selected options; the raw label is rendered unescaped and the script executes in that privileged browser session. No public exploit code is identified, but the fix commit and its regression test disclose a working payload pattern.