CVE-2026-63205: Zammad: Channel admins can read unauthorized attachments via signature rich-text body
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies that attachment into a new signature-owned record, without checking whether the user has permission to access the original attachment. The newly created copy is then downloadable by the same channel-admin user, because attachment access is determined by the copy's owner (the signature), not the original object (e.g., a ticket or knowledge-base article). This allows a user with any of the admin.channelemail, admin.channelgoogle, admin.channelmicrosoft365, or admin.channelmicrosoftgraph permissions to read attachments they would otherwise be denied access to, such as ticket attachments belonging to groups they are not a member of. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user needs any one of the admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions. These channel-admin permissions can allow access to attachments from objects the user is otherwise not authorized to read, including tickets in groups they do not belong to.
What does exploitation require?
The user must create or update an email signature containing an HTML img tag that references an existing attachment. The vulnerable processing copies the referenced attachment into a signature-owned record, from which the user can download it.
Are installations affected by default?
The issue affects Zammad versions prior to 7.1.2 when users with the listed channel-admin permissions can create or update email signatures and can reference existing attachments in signature HTML.
How can this be remediated?
Upgrade Zammad to version 7.1.2, which fixes the issue. If an immediate upgrade is not possible, restrict the listed channel-admin permissions for users who should not be able to access attachments outside their authorized groups.