# CVE-2026-84463: Zammad HTML injection in Knowledge Base video widget

Source: https://junglewise.ai/threats/cve-2026-84463-zammad-is-a-web-based-open-source-helpdesk-customer-support  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84463 · Severity: info · Published 2026-09-25

Zammad is an open-source helpdesk and customer support system. A user with Knowledge Base editing rights can inject malicious code into published answers through a specially crafted video widget. When another user views the answer, the injected code silently switches their logged-in session to an attacker-controlled account without any action required from the victim.

Technologies: [Zammad](https://junglewise.ai/threats/technologies/zammad). Vendors: [Zammad](https://junglewise.ai/threats/vendors/zammad).

## Quick answers

**Is CVE-2026-84463 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84463 being exploited in the wild.

**How severe is CVE-2026-84463?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** Zammad prior to 7.1.2.

**Is there a fix for CVE-2026-84463?** A patch was published on 2026: version 7.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84463 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84463?** Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored HTML injection vulnerability exists in the Knowledge Base video widget where user-supplied input is inserted into an iframe attribute without proper HTML escaping. An attacker with Knowledge Base editing rights can craft a malicious video widget value that breaks out of the attribute context and injects arbitrary HTML/JavaScript. When a user with session-switching permissions views the answer, the injected code makes a request to the session-switching endpoint, hijacking their active credentials.

## Affected products

- Zammad Zammad prior to 7.1.2

## Timeline

- 2026-09-25: disclosed
- 2026: patched: version 7.1.2

## References

- [https://github.com/zammad/zammad/commit/f7a97ea209696bce85ed62901ee753b88368851c](https://github.com/zammad/zammad/commit/f7a97ea209696bce85ed62901ee753b88368851c)
- [https://github.com/zammad/zammad/security/advisories/GHSA-cxjg-4gmf-5xqc](https://github.com/zammad/zammad/security/advisories/GHSA-cxjg-4gmf-5xqc)

## Related threats

- [Zammad stored cross-site scripting in ticket article rendering](https://junglewise.ai/threats/cve-2026-102345-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the)
- [Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack)
- [Zammad S/MIME signature verification bypass allows sender impersonation](https://junglewise.ai/threats/cve-2026-84465-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad unauthorized data access in External Data Source](https://junglewise.ai/threats/cve-2026-84464-zammad-is-a-web-based-open-source-helpdesk-customer-support)