CVE-2026-56732

Medium

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2.

SeverityMedium

CVSS5.3

Exploit probability—

Product

Zammad

PublishedSep 25, 2026

First seenSep 25, 2026

Weakness typeCWE-20Improper input validation CWE-352Cross-site request forgery (CSRF)

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
zammad zammad	< 7.0.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.