CVE-2026-56732: Zammad: Malicious input in Ticket Body Enables Session Termination
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.0.2
Event History
Frequently Asked Questions
Who can be affected by a crafted ticket?
Any Zammad user who views a ticket containing the malicious HTML can have their session terminated. The issue affects Zammad versions prior to 7.0.2.
What does an attacker need to exploit this issue?
The attacker needs to submit or otherwise place specially crafted HTML in a ticket body, then have another user view that ticket. The provided information describes session termination through a logout request, not account takeover.
Are installations running Zammad 7.0.2 affected?
No. The vulnerability is fixed in Zammad 7.0.2; versions prior to 7.0.2 are identified as affected.