{"id":"CVE-2026-102345","kind":"vulnerability","aliases":["CVE-2026-102345"],"related":[],"title":"Zammad: ticket article content renders unescaped, enabling stored cross-site scripting","description":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.","summary":"In Zammad versions before 7.1.2, the new Vue-based ticket interface displays article content without output encoding. An authenticated user can store markup in a ticket article that runs in the browser of another user who views the ticket.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helpdesk","other","self-hosted","zammad"],"not_affected_if":["classic-interface-only","zammad-7.1.2-or-later"],"how_to_check":"- Check the installed Zammad version in the admin panel or the release files; versions before `7.1.2` are exposed.\n- Confirm whether users use the new Vue-based ticket interface; the classic REST/CoffeeScript interface is not affected per the sources.","fix":"- Zammad: upgrade to `7.1.2`","status":"open","published_at":"2026-11-04T19:17:17+00:00","first_seen_at":"2026-11-04T19:28:47+00:00","triaged_at":"2026-11-04T19:30:16+00:00","updated_at":"2026-11-04T19:30:16+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T19:30:16Z","model":"claude-haiku-5-5","output":{"fix":"- Zammad: upgrade to `7.1.2`","reach":"network","title":"Zammad: ticket article content renders unescaped, enabling stored cross-site scripting","impact":"medium","summary":"In Zammad versions before 7.1.2, the new Vue-based ticket interface displays article content without output encoding. An authenticated user can store markup in a ticket article that runs in the browser of another user who views the ticket.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zammad","self-hosted","helpdesk"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker's script runs in another agent's browser session","analyst_note":"","how_to_check":"- Check the installed Zammad version in the admin panel or the release files; versions before `7.1.2` are exposed.\n- Confirm whether users use the new Vue-based ticket interface; the classic REST/CoffeeScript interface is not affected per the sources.","plain_action":"","needs_analyst":false,"not_affected_if":["classic-interface-only","zammad-7.1.2-or-later"],"who_is_affected":"Teams running self-hosted Zammad before 7.1.2 whose agents use the new Vue-based ticket interface. Any authenticated user who can write ticket articles can store the payload, and it fires when another user views the ticket. The sources say the classic interface is not affected and that the default Content Security Policy limits practical impact.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000691,"input_tokens":4190,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102345':15A,18A '-2026':14A,17A '7.1.2':29B,77C,141C 'affect':134C 'anoth':59B,108C 'articl':3A,38B,52B,88C,103C 'authent':44B,96C 'base':34B,69C,82C 'browser':57B 'classic':129C 'content':4A,39B,89C,121C 'cross':10A,116C 'cross-sit':9A,115C 'cve':13A,16A 'default':120C 'display':37B 'enabl':7A,113C 'encod':42B,94C 'expect':92C 'fix':138C 'helpdesk':19B 'helpdesk/customer':72C 'host':23B 'impact':126C 'interfac':36B,84C,131C 'interpret':106C 'issu':136C 'limit':124C 'markup':48B,100C 'new':31B,79C 'open':70C 'output':41B,93C 'polici':123C 'practic':125C 'prior':75C 'render':5A,86C 'rest/coffeescript':130C 'run':54B 'script':12A,118C 'secur':122C 'self':22B 'self-host':21B 'site':11A,117C 'sourc':71C 'store':8A,47B,99C,114C 'support':73C 'system':74C 'ticket':2A,35B,51B,64B,83C,87C,112C 'unescap':6A 'user':45B,60B,97C,109C 'version':27B,140C 'view':62B,110C 'vue':33B,81C 'vue-bas':32B,80C 'web':68C 'without':40B,90C 'zammad':1A,24B,26B,65C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Zammad before 7.1.2 whose agents use the new Vue-based ticket interface. Any authenticated user who can write ticket articles can store the payload, and it fires when another user views the ticket. The sources say the classic interface is not affected and that the default Content Security Policy limits practical impact.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["helpdesk","medium","other","selfhosted","zammad"],"campaign_type":null,"first_public_at":"2026-08-04T06:25:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102345","severity":null,"published_at":"2026-11-04T19:17:17+00:00","modified_at":"2026-11-04T19:17:17+00:00","first_seen_at":"2026-11-04T19:28:47+00:00","fetched_at":"2026-11-04T19:28:47+00:00","note":null}],"documents":[{"id":69719,"url":"https://github.com/zammad/zammad/commit/fe8fb9bd6c61f9136c93ef00cc08904bca0edecc","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69720,"url":"https://github.com/zammad/zammad/security/advisories/GHSA-4x3x-65c5-8hx4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-04T06:25:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}