Vulnerability Description
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.
Related Weaknesses (CWE)
References
- https://github.com/zammad/zammad/commit/fab2e2e9dac97b298d2c0f84b526aae2b1e6afab
- https://github.com/zammad/zammad/security/advisories/GHSA-48h2-wv8r-fgp9
FAQ
What is CVE-2026-63207?
CVE-2026-63207 is a documented vulnerability. Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration ad...
How severe is CVE-2026-63207?
CVSS scoring is not yet available for CVE-2026-63207. Check NVD for updates.
Is there a patch for CVE-2026-63207?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.