Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-84463— Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Quick assessment

Affected
zammad zammad
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zammad 是一个基于 Web 的开源帮助台/客户支持系统。在版本 7.1.2 之前，拥有某个知识分类编辑权限的用户可以通过构造特殊的值，在已发布的答案中嵌入视频小部件（video widget）。当该答案被渲染时，该特殊值会被未经属性上下文转义地插入到页面 HTML 中，从而能够跳出原有上下文，向页面注入额外的 HTML 代码。 当其他具有会话切换权限的用户查看受影响的已发布答案时，所注入的 HTML 代码会促使用户浏览器在不知情的情况下，使用其当前有效的凭据向 Zammad 的会话切换端点发送请求。这会导致该

CVSS 6.3 · Medium EPSS 0.15% · P4
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84463

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
Source: CVE Program / CVE List V5
Vulnerability Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML without being escaped for its attribute context, allowing it to break out and inject additional HTML into the page. When another user who has permission to switch between user sessions views the affected answer, the injected HTML causes their browser to silently send a request to Zammad's session-switching endpoint using their own active credentials. This results in switching their session to an account chosen by the person who wrote the Knowledge Base answer. No action is required from the viewer beyond opening the published answer. This issue is fixed in version 7.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zammad zammad < 7.1.2 -

II. Public POCs for CVE-2026-84463

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84463

请登录查看更多情报信息。

Other References for CVE-2026-84463 (2)

Same Patch Batch · zammad · 2026-09-25 · 30 CVEs total

CVE-2026-84458 9.1 CRITICAL Zammad: Account takeover via unverified email matching during SSO auto-link
CVE-2026-61525 8.8 HIGH Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Control
CVE-2026-56733 8.7 HIGH Zammad: Incorrect Authorization and Improper Privilege Management
CVE-2026-56725 8.7 HIGH Zammad: Denial of Service via OTRS Import Controller
CVE-2026-84462 8.6 HIGH Zammad: AI Agent template sanitizer bypass leads to remote code execution
CVE-2026-56731 8.4 HIGH Zammad: Cross-Site Scripting in Ticket Notifications
CVE-2026-56724 7.1 HIGH Zammad: Incorrect implementation of permission checks in the knowledge base module
CVE-2026-84465 7.1 HIGH Zammad: S/MIME signature verification allows forged sender impersonation
CVE-2026-84464 7.1 HIGH Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organizati
CVE-2026-56727 7.1 HIGH Zammad: PGP signature spoofing via unvalidated verification return
CVE-2026-56723 7.1 HIGH Zammad: Missing authorization on ticket attachment download
CVE-2026-84461 6.9 MEDIUM Zammad: Missing rate limiting allows password brute-forcing during two-factor login
CVE-2026-63207 6.9 MEDIUM Zammad: Sensitive Information Exposure in Integration Administration API
CVE-2026-56735 5.3 MEDIUM Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
CVE-2026-56728 5.3 MEDIUM Zammad: Cross-User Taskbar Item Access Control Vulnerability
CVE-2026-56732 5.3 MEDIUM Zammad: Malicious input in Ticket Body Enables Session Termination
CVE-2026-56734 5.3 MEDIUM Zammad: Avatar Image URL Server-Side Request Forwarding
CVE-2026-84460 5.3 MEDIUM Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
CVE-2026-63206 5.3 MEDIUM Zammad: Remote image tracking bypass via shortened URL scheme
CVE-2026-61855 5.3 MEDIUM Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Showing top 20 of 30 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: zammad
Same vendor: zammad
Same weakness: CWE-79

V. Comments for CVE-2026-84463

No comments yet

Leave a comment