CVE-2026-63216: Zammad Admin UI XSS Vulnerability

CVE-2026-63216 Overview

Zammad, a web-based open source helpdesk and customer support system, contains a stored cross-site scripting vulnerability in versions prior to 7.1.2. The flaw resides in the AI Agents configuration dialogs within the admin UI, where option labels render as raw HTML without sanitization. An attacker who controls an option label, such as a user or organization name used in a relation attribute, can inject arbitrary HTML and JavaScript. The payload executes in the browser of any administrator or agent who opens the affected object attribute configuration view. The vulnerability is categorized under [CWE-80] (Improper Neutralization of Script-Related HTML Tags in a Web Page).

Critical Impact
Low-privileged users can inject JavaScript that executes in the context of admin or agent sessions, enabling session hijacking, privilege escalation, or arbitrary administrative actions.

Affected Products

Zammad helpdesk/customer support system
All versions prior to 7.1.2
AI Agents configuration dialog in the admin UI

Discovery Timeline

2026-09-25 - CVE CVE-2026-63216 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-63216

Vulnerability Analysis

The vulnerability is a stored cross-site scripting (XSS) issue affecting Zammad's admin UI rendering logic for object attribute options. When the application renders the list of selected options in the AI Agents configuration dialog, it outputs the option label field as raw HTML. Because the label is never escaped, any HTML or JavaScript present in the label string is parsed and executed by the browser. An attacker needs only low privileges to populate attacker-controlled strings that end up as option labels, such as a user name, organization name, or a custom attribute option value.

Root Cause

The root cause lies in two template components. The CoffeeScript controller object_attribute_options_context.coffee passed label values through App.i18n.translateInline, which can produce HTML output. The Eco template object_attribute_options_context.jst.eco then rendered the label using the unescaped output tag <%- option.label %>, which bypasses HTML escaping entirely.

Attack Vector

Exploitation requires authenticated access with the ability to set a value that is later surfaced as an option label. For example, an attacker modifies their own user record, an organization name, or supplies a crafted custom attribute option. When an admin or agent subsequently opens the AI Agents object attribute configuration view, the injected script runs in the victim's browser session, inheriting their privileges within Zammad.

text

// Patch: app/assets/javascripts/app/controllers/_ui_element/object_attribute_options_context.coffee
         _.map(related_object_attribute.options, (label, value) ->
           {
             value: value
-            label: if related_object_attribute.translate then App.i18n.translateInline(label) else label
+            label: if related_object_attribute.translate then App.i18n.translatePlain(label) else label
           }
         )

Source: Zammad commit 74b4fd4

text

// Patch: app/assets/javascripts/app/views/generic/object_attribute_options_context.jst.eco
       <tbody>
       <% for option in @optionsSelected: %>
         <tr data-id="<%= option.value %>">
-          <td><%- option.label %></td>
+          <td><%= option.label %></td>
           <% if @showDescription: %><td><textarea class="form-control js-description"><%- @T(option.description) %></textarea></td><% end %>

The fix replaces translateInline with translatePlain and swaps the unescaped Eco tag <%- %> for the HTML-escaping tag <%= %>. Source: Zammad commit 74b4fd4.

Detection Methods for CVE-2026-63216

Indicators of Compromise

User, organization, or custom attribute option values that contain HTML tags such as <script>, <img onerror=>, or <svg onload=>.
Unexpected outbound requests from admin or agent browsers to attacker-controlled domains after opening object attribute configuration views.
New or modified admin accounts, API tokens, or triggers created shortly after an admin opened an AI Agents configuration dialog.

Detection Strategies

Query the Zammad database for user, organization, and object attribute records containing HTML-significant characters such as <, >, or javascript: in name or label fields.
Review web server access logs for admin UI requests to object_attribute_options_context endpoints followed by anomalous session activity.
Correlate audit log entries for configuration changes with recent admin logins to identify sessions potentially acting under injected script control.

Monitoring Recommendations

Monitor Zammad audit logs for creation of relation attributes, custom attribute options, and admin role assignments.
Enable Content Security Policy (CSP) reporting to flag inline script execution attempts in the Zammad UI.
Alert on changes to user or organization names that include non-standard characters indicative of HTML injection.

How to Mitigate CVE-2026-63216

Immediate Actions Required

Upgrade all Zammad instances to version 7.1.2 or later, which contains the official fix.
Audit existing user, organization, and custom attribute option values for embedded HTML or JavaScript payloads and sanitize them.
Rotate admin and agent session tokens if the environment was running an affected version with untrusted users.

Patch Information

The vulnerability is fixed in Zammad 7.1.2. The remediation is implemented in commit 74b4fd4db62dc3652bb9db24096a2fbd1b56dc7f and detailed in GitHub Security Advisory GHSA-r95m-ghj7-646x. The fix switches the Eco template to the HTML-escaping output tag and uses translatePlain instead of translateInline for label rendering.

Workarounds

Restrict the ability to create or modify users, organizations, and custom attribute options to trusted administrators until the patch is applied.
Limit admin and agent access to the AI Agents object attribute configuration view on unpatched instances.
Deploy a strict Content Security Policy that disallows inline script execution in the Zammad web UI to reduce exploitability.

bash

# Upgrade Zammad to the patched release
# Docker example
docker pull zammad/zammad:7.1.2
docker compose up -d

# Package-based installations
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade zammad

# Verify the installed version
zammad run rails runner 'puts Zammad::Application.config.version'