CVE-2026-102345 · Other
NO FIX YET · SEE WHAT TO DO
In Zammad versions before 7.1.2, the new Vue-based ticket interface displays article content without output encoding. An authenticated user can store markup in a ticket article that runs in the browser of another user who views the ticket.
first public Aug 4, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running self-hosted Zammad before 7.1.2 whose agents use the new Vue-based ticket interface. Any authenticated user who can write ticket articles can store the payload, and it fires when another user views the ticket. The sources say the classic interface is not affected and that the default Content Security Policy limits practical impact.
Not affected if classic-interface-only, zammad-7.1.2-or-later
Who cares helpdesk, self-hosted, zammad
7.1.2 are exposed.7.1.2Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-102345") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.