Vulnerability Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization. This issue is fixed in version 7.0.1.
Related Weaknesses (CWE)
References
- https://github.com/zammad/zammad/commit/16a4a2e1be6642ec0c3ba3a76e358ad065f48f78
- https://github.com/zammad/zammad/security/advisories/GHSA-p9xp-gx8r-4397
FAQ
What is CVE-2026-56731?
CVE-2026-56731 is a documented vulnerability. Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a tic...
How severe is CVE-2026-56731?
CVSS scoring is not yet available for CVE-2026-56731. Check NVD for updates.
Is there a patch for CVE-2026-56731?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.