What’s Vulnerable › Vulnerabilities

CVE-2026-63207: Zammad: Sensitive Information Exposure in Integration Administration API

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-09-29
• Weakness: CWE-200

Description

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.

Affected products

• zammad: before 7.1.2

References

• https://github.com/zammad/zammad/commit/fab2e2e9dac97b298d2c0f84b526aae2b1e6afab
• https://github.com/zammad/zammad/security/advisories/GHSA-48h2-wv8r-fgp9

Get alerted when CVE-2026-63207 or the next vulnerability affects your stack