# CVE-2026-63216: Zammad stored XSS in option labels configuration dialog

Source: https://junglewise.ai/threats/cve-2026-63216-zammad-is-a-web-based-open-source-helpdesk-customer-support  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-63216 · Severity: info · Published 2026-09-25

Zammad is a web-based help desk and customer support system used by organizations to manage tickets and support requests. Prior to version 7.1.2, attackers with low privileges can inject malicious JavaScript into option labels that are displayed without sanitization in the admin configuration interface. When administrators or agents open the affected configuration dialogs, the injected script executes in their browsers, potentially allowing the attacker to steal sensitive information or perform unauthorized actions on their behalf.

Technologies: [Zammad](https://junglewise.ai/threats/technologies/zammad). Vendors: [Zammad](https://junglewise.ai/threats/vendors/zammad).

## Quick answers

**Is CVE-2026-63216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63216 being exploited in the wild.

**How severe is CVE-2026-63216?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** Zammad <= 7.1.1.

**Is there a fix for CVE-2026-63216?** A patch was published on 2026-08-03: Version 7.1.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63216 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63216?** Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the AI Agents configuration UI where option labels are rendered as raw HTML without escaping. An attacker with low privileges (such as a regular user or agent) can supply malicious HTML/JavaScript through relation attributes (e.g., crafted user or organization names) or custom attribute option values. The payload executes in the browser of any admin or agent who opens the object attribute configuration view, affecting the confidentiality and integrity of their session.

## Affected products

- Zammad Zammad <= 7.1.1

## Timeline

- 2026-09-25: disclosed
- 2026-08-03: patched: Version 7.1.2 released with fix

## References

- [https://github.com/zammad/zammad/commit/74b4fd4db62dc3652bb9db24096a2fbd1b56dc7f](https://github.com/zammad/zammad/commit/74b4fd4db62dc3652bb9db24096a2fbd1b56dc7f)
- [https://github.com/zammad/zammad/security/advisories/GHSA-r95m-ghj7-646x](https://github.com/zammad/zammad/security/advisories/GHSA-r95m-ghj7-646x)

## Related threats

- [Zammad stored cross-site scripting in ticket article rendering](https://junglewise.ai/threats/cve-2026-102345-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the)
- [Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack)
- [Zammad S/MIME signature verification bypass allows sender impersonation](https://junglewise.ai/threats/cve-2026-84465-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad unauthorized data access in External Data Source](https://junglewise.ai/threats/cve-2026-84464-zammad-is-a-web-based-open-source-helpdesk-customer-support)