CVE-2026-63207
Zammad: Sensitive Information Exposure in Integration Administration API
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.
| CWE | CWE-200 CWE-312 CWE-522 |
| Vendor | zammad |
| Product | zammad |
| Published | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for zammad zammad
Be the first to know when new unknown vulnerabilities affecting zammad zammad are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
zammad / zammad
< 7.1.2