CVE-2026-63204 Details
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run belongs to a ticket the agent is not authorized to access. The disclosure is limited to the provider error string; ticket content is not exposed. This issue is fixed in version 7.1.2.
A vulnerability exists in Zammad versions prior to 7.1.2, allowing authenticated users with agent permissions to access AI analytics error messages from tickets they do not have authorization to view. This is achieved by supplying a specific AI analytics run identifier to the ticket summarize endpoint. While the error message from the AI provider is disclosed, the actual ticket content remains protected.
Users can upgrade to Zammad version 7.1.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zammad/zammad/commit/849191c32a76f62fbd7cf4582a2b1e05e25f25ed | [email protected] | Source CodeVendor |
| https://github.com/zammad/zammad/security/advisories/GHSA-75j9-hpg4-j9f8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zammad | <= 7.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | New CVE Received | [email protected] |
| Sep 25, 2026 | CVE Modified | CISA-ADP |