Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63208— Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Quick assessment

Affected
zammad zammad
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zammad 是一款基于 Web 的开源客服/客户支持系统。在 7.1.2 版本之前，当 Microsoft Graph 请求失败时，Zammad 会将使用的身份验证令牌记录在日志中，以协助排查与邮箱访问相关的问题。系统试图对日志中的该令牌进行遮蔽处理，但遮蔽不完整：对于 Microsoft 使用的 JWT 令牌格式，系统仅隐藏了令牌的第一部分，而其余部分仍以明文形式暴露。拥有 Microsoft Graph 通道访问权限的 Zammad 管理员可以查看这些日志，从而获取部分令牌信息，这可能泄露敏感声明（例如账户作

CVSS 5.1 · Medium EPSS 0.31% · P21
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63208

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
Source: CVE Program / CVE List V5
Vulnerability Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft uses (JWT), only the first part is hidden, while the remaining parts remain readable in plain text. A Zammad admin with Microsoft Graph channel access can view these logs and see the partial token, which may reveal sensitive claims such as the account scope, tenant, or timing, and could assist in reconstructing the full token while it is still valid. This issue is fixed in version 7.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zammad zammad < 7.1.2 -

II. Public POCs for CVE-2026-63208

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63208

请登录查看更多情报信息。

Other References for CVE-2026-63208 (2)

Same Patch Batch · zammad · 2026-09-25 · 30 CVEs total

CVE-2026-84458 9.1 CRITICAL Zammad: Account takeover via unverified email matching during SSO auto-link
CVE-2026-61525 8.8 HIGH Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Control
CVE-2026-56733 8.7 HIGH Zammad: Incorrect Authorization and Improper Privilege Management
CVE-2026-56725 8.7 HIGH Zammad: Denial of Service via OTRS Import Controller
CVE-2026-84462 8.6 HIGH Zammad: AI Agent template sanitizer bypass leads to remote code execution
CVE-2026-56731 8.4 HIGH Zammad: Cross-Site Scripting in Ticket Notifications
CVE-2026-56724 7.1 HIGH Zammad: Incorrect implementation of permission checks in the knowledge base module
CVE-2026-56723 7.1 HIGH Zammad: Missing authorization on ticket attachment download
CVE-2026-56727 7.1 HIGH Zammad: PGP signature spoofing via unvalidated verification return
CVE-2026-84465 7.1 HIGH Zammad: S/MIME signature verification allows forged sender impersonation
CVE-2026-84464 7.1 HIGH Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organizati
CVE-2026-84461 6.9 MEDIUM Zammad: Missing rate limiting allows password brute-forcing during two-factor login
CVE-2026-63207 6.9 MEDIUM Zammad: Sensitive Information Exposure in Integration Administration API
CVE-2026-84463 6.3 MEDIUM Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switch
CVE-2026-84460 5.3 MEDIUM Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
CVE-2026-56728 5.3 MEDIUM Zammad: Cross-User Taskbar Item Access Control Vulnerability
CVE-2026-56735 5.3 MEDIUM Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
CVE-2026-56732 5.3 MEDIUM Zammad: Malicious input in Ticket Body Enables Session Termination
CVE-2026-56734 5.3 MEDIUM Zammad: Avatar Image URL Server-Side Request Forwarding
CVE-2026-63206 5.3 MEDIUM Zammad: Remote image tracking bypass via shortened URL scheme

Showing top 20 of 30 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: zammad
Same vendor: zammad
Same weakness: CWE-116

V. Comments for CVE-2026-63208

No comments yet

Leave a comment