CVE-2026-84463: Zammad Helpdesk XSS Vulnerability

CVE-2026-84463 Overview

CVE-2026-84463 is a stored cross-site scripting (XSS) vulnerability in Zammad, an open source web-based helpdesk and customer support system. A user with Knowledge Base editing rights for a category can embed a video widget in a published answer using a specially crafted value. The crafted value is inserted into the rendered page HTML without proper attribute-context escaping, allowing the attacker to break out of the attribute and inject arbitrary HTML. The vulnerability is fixed in version 7.1.2.

Critical Impact
When a privileged viewer with session-switching permission opens the poisoned Knowledge Base answer, their browser silently issues a session-switch request using their own credentials, hijacking their session into an attacker-chosen account.

Affected Products

Zammad versions prior to 7.1.2
Zammad Knowledge Base module (video widget rendering)
Zammad helper app/helpers/knowledge_base_rich_text_helper.rb

Discovery Timeline

2026-09-25 - CVE-2026-84463 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-84463

Vulnerability Analysis

The vulnerability resides in Zammad's Knowledge Base rich-text helper that renders video embed markers into HTML <iframe> elements. The helper parses a marker string into a settings hash containing a provider (such as youtube or vimeo) and an id. It then interpolates both values directly into an HTML template without escaping, producing an <iframe> whose id attribute and src attribute contain attacker-controlled strings.

Because the interpolated values are placed inside single-quoted HTML attributes without sanitization, a crafted id value containing a single quote and additional markup can terminate the attribute and inject new attributes or tags into the surrounding <div class='videoWrapper'> wrapper. The injected HTML executes in the context of the rendered Knowledge Base answer. This is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is unescaped string interpolation of user-supplied values inside HTML attribute contexts. The settings parser also split on : without a limit, allowing malformed URL-like values to flow unchanged into the src attribute. No call to CGI.escapeHTML or equivalent attribute-context escaping was applied before concatenation.

Attack Vector

An authenticated user with Knowledge Base editing rights authors a published answer containing a crafted video marker. When a second user who holds session-switching privilege views the answer, the injected HTML issues a background request to Zammad's session-switching endpoint using the viewer's own cookies. The viewer's session is transparently switched to an account chosen by the attacker, with no viewer interaction beyond opening the page.

ruby

       settings = match
         .slice(1...-1)
         .split(',')
-        .to_h { |pair| pair.split(':').map(&:strip) }
+        .to_h { |pair| pair.split(':', 2).map(&:strip) }
         .symbolize_keys
 
+      escaped_id = CGI.escape(settings[:id].to_s)
+
       url = case settings[:provider]
             when 'youtube'
-              "https://www.youtube.com/embed/#{settings[:id]}"
+              "https://www.youtube.com/embed/#{escaped_id}"
             when 'vimeo'
-              "https://player.vimeo.com/video/#{settings[:id]}"
+              "https://player.vimeo.com/video/#{escaped_id}"
             end
 
       return match if !url
 
-      "<div class='videoWrapper'><iframe allowfullscreen id='#{settings[:provider]}#{settings[:id]}' type='text/html' src='#{url}' frameborder='0'></iframe></div>"
+      id_attribute = CGI.escapeHTML("#{settings[:provider]}#{settings[:id]}")
+
+      "<div class='videoWrapper'><iframe allowfullscreen id='#{id_attribute}' type='text/html' src='#{CGI.escapeHTML(url.to_s)}' frameborder='0'></iframe></div>"
     end
   end

Source: Zammad patch commit f7a97ea. The patch applies CGI.escape to the video id before URL construction and CGI.escapeHTML to both the composed id attribute and the final src URL before HTML interpolation.

Detection Methods for CVE-2026-84463

Indicators of Compromise

Knowledge Base answers containing video markers whose id fields include characters such as ', <, >, =, or whitespace outside expected provider ID formats.
Unexpected session-switch events in Zammad audit logs where the switching user did not actively initiate the change.
HTTP requests to Zammad's session-switching endpoint originating from a Referer pointing to a Knowledge Base answer page.

Detection Strategies

Review stored Knowledge Base content for <iframe> elements with malformed id attributes or attribute boundaries that break out of single quotes.
Correlate Knowledge Base answer views with session-switch endpoint calls occurring in the same request chain for the same user.
Flag Knowledge Base edits by non-administrator editors that introduce video widgets using provider or ID values outside an allowlist (YouTube or Vimeo IDs only).

Monitoring Recommendations

Enable and forward Zammad application and audit logs to a centralized log store, filtering for session-switching events and Knowledge Base publish actions.
Monitor web server access logs for suspicious POST requests to session-switch endpoints with Knowledge Base referrers.
Alert on new Knowledge Base editors being granted category edit rights, since exploitation requires that privilege.

How to Mitigate CVE-2026-84463

Immediate Actions Required

Upgrade Zammad to version 7.1.2 or later, which contains the fix in knowledge_base_rich_text_helper.rb.
Audit all published Knowledge Base answers created or modified before the upgrade for anomalous video markers and remove suspect content.
Review which accounts hold Knowledge Base category edit rights and which hold session-switching permission, and reduce both where possible.

Patch Information

The fix is delivered in Zammad 7.1.2 via commit f7a97ea209696bce85ed62901ee753b88368851c. The patch escapes the video id for URL safety using CGI.escape, escapes the composed id attribute and src URL using CGI.escapeHTML, and limits attribute splitting to two parts so colons inside values do not corrupt parsing. See the Zammad GitHub Security Advisory GHSA-cxjg-4gmf-5xqc for vendor guidance.

Workarounds

Restrict Knowledge Base editing rights to trusted users until the upgrade is applied, since exploitation requires an authenticated editor.
Temporarily disable use of the video widget in Knowledge Base categories, or remove the video marker rendering path if operationally feasible.
Instruct users with session-switching privilege to avoid opening unreviewed Knowledge Base answers until patching is complete.

bash

# Verify the running Zammad version and upgrade
zammad run rails r 'puts Version.get'
# Package-based upgrade example (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade zammad
# Docker-based upgrade example
docker pull zammad/zammad:7.1.2
docker compose up -d