CVE-2026-56731: Zammad Helpdesk XSS Vulnerability

CVE-2026-56731 Overview

CVE-2026-56731 is a stored Cross-Site Scripting (XSS) vulnerability in Zammad, an open source web-based helpdesk and customer support platform. A low-privilege authenticated user can inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title through the standard ticket creation workflow. Zammad persists the title without sanitization, causing the payload to execute when other users—including agents and administrators—view the affected ticket. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Zammad fixed the issue in version 7.0.1.

Critical Impact
An authenticated attacker with minimal privileges can execute arbitrary JavaScript in the browsers of helpdesk agents and administrators, enabling session theft, privilege escalation, and unauthorized ticket actions.

Affected Products

Zammad versions prior to 7.0.1
Zammad helpdesk ticket creation workflow
Self-hosted and container deployments of Zammad

Discovery Timeline

2026-09-25 - CVE-2026-56731 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-56731

Vulnerability Analysis

The vulnerability resides in how Zammad handles the ticket title field during ticket creation. The application accepts the title string from the authenticated user, stores it in the database, and later renders it in agent and administrator views without applying HTML sanitization or output encoding. Any HTML tags or inline JavaScript event handlers submitted in the title persist and execute in the context of the viewing user's session.

Because Zammad is a shared helpdesk platform, a low-privilege user (such as a customer account) can target privileged agents who routinely review incoming tickets. Successful exploitation grants the attacker JavaScript execution under the victim's origin, which allows session token theft, forced API calls, and modification of ticket data on behalf of the agent.

Root Cause

The root cause is missing input sanitization and output encoding on the ticket.title field. The ticket creation workflow trusts the submitted title and persists it verbatim. Downstream rendering templates—including notification and escalation views—interpolate the stored title into HTML without escaping dangerous characters such as <, >, and quote delimiters.

Attack Vector

An attacker with a valid low-privilege Zammad account creates a new ticket and sets the title to a crafted payload containing HTML markup or event handler attributes. When any user with elevated permissions opens the ticket queue, dashboard, or notification referencing the ticket, the browser parses the title as HTML and executes the embedded script. User interaction is required because a victim must view the malicious ticket.

ruby

# Patch excerpt from app/models/ai/agent/type.rb
# Source: https://github.com/zammad/zammad/commit/16a4a2e1be6642ec0c3ba3a76e358ad065f48f78

      placeholder_pattern = "\#{placeholder.#{placeholder_name}}"
      replacement_value = enrichment_data[placeholder_name] || ''

-     structure_string = structure_string.gsub(placeholder_pattern, replacement_value.to_s)
+     sanitized_value = replacement_value.to_s.gsub('<%', '<%%')
+     structure_string = structure_string.gsub(placeholder_pattern, sanitized_value)
    end

    structure_string

The patch escapes ERB template delimiters in user-controlled replacement values before interpolation, closing a template injection surface that compounds the stored XSS risk in notification rendering.

Detection Methods for CVE-2026-56731

Indicators of Compromise

Ticket titles containing HTML tags such as <script>, <img>, <svg>, or <iframe>
Ticket titles containing inline event handlers like onerror=, onload=, onmouseover=, or onfocus=
Unexpected outbound HTTP requests from agent browsers to attacker-controlled hosts shortly after opening a ticket
Session tokens or API keys appearing in web server access logs for the Zammad origin

Detection Strategies

Query the Zammad database for ticket titles matching regular expressions targeting HTML tags and event handler attributes
Review web application firewall (WAF) logs for POST requests to /api/v1/tickets containing angle brackets or JavaScript keywords in the title parameter
Monitor browser Content Security Policy (CSP) violation reports from the Zammad frontend for inline script executions

Monitoring Recommendations

Enable verbose audit logging on the Zammad ticket creation API and forward logs to a centralized SIEM for correlation
Alert on anomalous ticket creation volume from newly registered low-privilege accounts
Track agent account activity for unexpected privilege changes, password resets, or API token generation following ticket interactions

How to Mitigate CVE-2026-56731

Immediate Actions Required

Upgrade all Zammad instances to version 7.0.1 or later without delay
Audit existing ticket titles for stored HTML or JavaScript payloads and sanitize or purge affected records
Rotate agent and administrator session tokens and API credentials if exploitation is suspected
Restrict ticket creation to vetted user groups until the upgrade is verified in production

Patch Information

Zammad released a fix in version 7.0.1. The remediation is tracked in the GitHub Security Advisory GHSA-p9xp-gx8r-4397 and implemented in commit 16a4a2e1. Administrators running packaged distributions should apply vendor updates for Debian, RPM, or container images that bundle Zammad 7.0.1.

Workarounds

Deploy a strict Content Security Policy that disallows inline script execution on the Zammad frontend
Place a WAF in front of Zammad with rules blocking HTML tags and event handlers in the title parameter of ticket creation requests
Temporarily disable self-registration or restrict ticket submission to trusted authenticated users until patching is complete

bash

# Verify installed Zammad version and upgrade via package manager
zammad run rails r 'puts Zammad::Version.get'

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade zammad

# RHEL/CentOS
sudo yum update zammad

# Docker Compose
docker compose pull zammad && docker compose up -d