CVE-2026-56732

UNKNOWN 0.0

Zammad: Malicious input in Ticket Body Enables Session Termination

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2.

CWE	CWE-20 CWE-352
Vendor	zammad
Product	zammad
Published	Sep 25, 2026
Last Updated	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for zammad zammad

Be the first to know when new unknown vulnerabilities affecting zammad zammad are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

zammad / zammad

< 7.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zammad/zammad/security/advisories/GHSA-6rmm-28j9-q99q github.com: https://github.com/zammad/zammad/commit/3f6e8a5fa34eb0ce40f63292cf744f5f2992c9d0 github.com: https://github.com/zammad/zammad/releases/tag/7.0.2