---
id: CVE-2026-63216
title: Zammad is a web based open source helpdesk/customer support system
summary: >-
  Zammad is a web based open source helpdesk/customer support system. Prior to
  7.1.2, unsanitized option labels are rendered in the configuration dialogs of
  AI Agents within Zammad's admin UI. When rendering the list of selected
  options, t…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-80
vendor: zammad
product: zammad
affected:
  - zammad < 7.1.2
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T19:17:55.517'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63216'
references:
  - url: >-
      https://github.com/zammad/zammad/commit/74b4fd4db62dc3652bb9db24096a2fbd1b56dc7f
    label: security-advisories@github.com
  - url: 'https://github.com/zammad/zammad/security/advisories/GHSA-r95m-ghj7-646x'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-25T19:15:39.033Z'
epss: 0.00243
epssPercentile: 0.13928
---

## Overview

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An attacker who can control an option label, for example by setting a malicious string as a user or organization name used in a relation attribute, or by supplying a crafted custom attribute option value, can inject arbitrary HTML and JavaScript. The payload executes in the browser of any admin or agent who opens the affected object attribute configuration view. This issue is fixed in version 7.1.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.