MajorCritical vulnerability

CVE-2026-56731 (CVSS 8.4)

NVD · officialPublished Sep 25, 2026Risk 37/100

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization. This issue is fixed in version 7.0.1.

Technical details

CVSS

8.4

AV:NetworkAC:LowPR:LowUI:Active

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source