---
id: "CVE-2026-102345"
kind: "vulnerability"
aliases: ["CVE-2026-102345"]
title: "Zammad: ticket article content renders unescaped, enabling stored cross-site scripting"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["helpdesk", "other", "self-hosted", "zammad"]
not_affected_if: ["classic-interface-only", "zammad-7.1.2-or-later"]
published_at: "2026-11-04T19:17:17+00:00"
first_seen_at: "2026-11-04T19:28:47+00:00"
updated_at: "2026-11-04T19:30:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102345", "first_seen_at": "2026-11-04T19:28:47+00:00"}]
---

# Zammad: ticket article content renders unescaped, enabling stored cross-site scripting

In Zammad versions before 7.1.2, the new Vue-based ticket interface displays article content without output encoding. An authenticated user can store markup in a ticket article that runs in the browser of another user who views the ticket.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Zammad version in the admin panel or the release files; versions before `7.1.2` are exposed.
- Confirm whether users use the new Vue-based ticket interface; the classic REST/CoffeeScript interface is not affected per the sources.

## Fix

- Zammad: upgrade to `7.1.2`

## Timeline

- 2026-11-04T19:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102345

## Documents

- [advisory] Vendor advisory: github.com https://github.com/zammad/zammad/security/advisories/GHSA-4x3x-65c5-8hx4
- [fix] Patch: github.com https://github.com/zammad/zammad/commit/fe8fb9bd6c61f9136c93ef00cc08904bca0edecc

## From the sources

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_