CVE-2026-63216: Zammad: Stored XSS via unescaped option labels in the object attribute options context UI
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An attacker who can control an option label, for example by setting a malicious string as a user or organization name used in a relation attribute, or by supplying a crafted custom attribute option value, can inject arbitrary HTML and JavaScript. The payload executes in the browser of any admin or agent who opens the affected object attribute configuration view. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Who can trigger the malicious script, and whose browser executes it?
An attacker must be able to control an option label, such as a user or organization name used in a relation attribute or a crafted custom attribute option value. The script executes in the browser of an administrator or agent who opens the affected object attribute configuration view.
Are all Zammad installations affected?
The issue affects Zammad versions before 7.1.2 when unsanitized option labels are rendered in the relevant AI Agents admin configuration dialogs. Version 7.1.2 includes the fix.
Where should administrators look for exposure?
Review object attribute option labels that can originate from user names, organization names, relation attributes, or custom attribute option values. In particular, investigate labels containing HTML-like markup or JavaScript payloads that may be displayed in the affected configuration view.