Zammad EUVD-2026-87264

Requires the attacker to already hold Knowledge Base editing rights for a category so they can author and publish an answer embedding a video widget (the injection point is the widget's 'id' value interpolated into an <iframe> attribute). Exploitation additionally requires a victim who holds the session-switching ('switch to user'/impersonation) permission to simply view the published answer - the malicious request fires automatically on render with no further victim action. Limiting factors: two distinct privilege prerequisites (attacker=KB editor, victim=session-switch-capable, typically admin/elevated agent), the requirement that the answer be published and viewed, and the niche self-hosted deployment base. Fixed in 7.1.2.

This is a genuine but conditionally-gated stored XSS (CWE-79) that chains into a forced session-switch account takeover - not a raw high-severity remote flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network reach but requires privileges (PR:L = the attacker needs Knowledge Base editing rights for a category) and user interaction (UI:P = a victim must open the published answer). Notably the vendor scored VC/VI/VA as N and pushed impact onto the subsequent-system metrics SC:H/SI:H, modeling the fact that the harm lands on the VIEWER'S session (which is switched to an attacker-chosen account) rather than the vulnerable Zammad instance itself - this is a defensible but non-obvious modeling choice, and it is why the base score is only 6.3 despite the takeover outcome. Exploitation is doubly gated: the attacker must already hold KB-editor rights AND the victim must be a user who possesses the session-switching ('switch to user'/impersonation) permission, i.e. typically an admin or elevated agent. No EPSS score, KEV listing, or public exploit was provided in the input; the fix commit's spec file discloses the payload shape ('id: a\' srcdoc=...') but that is a regression test, not weaponized exploit code. Overall a real but not urgent priority: the outcome (impersonation of a privileged viewer) is severe, but the two required privilege preconditions and the niche product footprint keep real-world risk moderate.

An attacker holding Knowledge Base category-editing rights publishes an answer containing a video widget whose 'id' value breaks out of the iframe attribute context (e.g. injecting a srcdoc/img that GETs /api/v1/sessions/switch/N). When an admin or agent who has session-switching permission opens that published answer, their browser silently issues the request with their own active credentials, switching their session to an account the attacker selected - no interaction beyond viewing is needed. No public exploit was identified at the time of analysis, though the vendor's fix commit includes a spec test demonstrating the attribute-breakout payload.