Zammad EUVD-2026-87271

Requires (1) a Zammad instance older than 7.1.2 configured with a Microsoft Graph email channel, (2) a failed Graph API request that triggers the error logging path storing the Authorization: Bearer header in http_log, and (3) an attacker who is an authenticated Zammad administrator with Microsoft Graph channel access and the ability to read HTTP logs (PR:H). It only exposes JWT-format (dot-separated) Bearer tokens; the leak is limited to the payload and signature segments and yields only a partial/still-valid token plus claims. Exploitation is gated by administrative privilege, the presence of the Graph integration, and the occurrence of a request failure - it is not remotely reachable by unauthenticated users.

This is a low-severity information-disclosure issue that is correctly rated modest by NVD's CVSS 4.0 score of 5.1 (AV:N/AC:L/PR:H/UI:N/VC:L, subsequent SC:L). The single most important limiting signal is PR:H: exploitation requires an already-privileged Zammad administrator who has Microsoft Graph channel access and can read the HTTP logs, so this is not a remote-unauthenticated concern despite the AV:N attack vector. The impact is bounded - only a JWT's payload and signature segments leak (the header segment was already masked), yielding claims such as tenant, scope, and timing plus material that 'could assist in reconstructing' the token; it is not a guaranteed full-credential disclosure, which is why VC:L (not H) is appropriate. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so exploitation status is 'no public exploit identified.' No conflicting signals exist between the CVSS vector and the description - both agree this needs authenticated admin/log access. Overall this is a low-priority patch: a defense-in-depth logging-hygiene fix rather than an urgent exposure. Note the CWE-116 (improper output encoding) label is a loose fit; the real weakness class is sensitive-data exposure in logs (CWE-200/532).

A Zammad instance is configured with a Microsoft Graph mail channel and a Graph API request fails, causing Zammad to log the outgoing request including the Bearer JWT. A Zammad administrator with access to those HTTP logs opens them and reads the unmasked payload and signature segments of the still-valid token, exposing tenant/scope claims and material that could aid token reconstruction. No public exploit code exists and exploitation requires existing admin/log-read privileges rather than remote unauthenticated access.